A suspected ShinyHunters member known online as “Rey” has reportedly been detained in Jordan and is cooperating with the FBI, according to Reuters. The outlet names him as Saif al-Din Khader and says two sources put his detention on Tuesday. One source told Reuters he is walking investigators through his devices and communications to identify and locate other members of the extortion group, and that his cooperation is “critical” to ongoing efforts to arrest them.
The report lands amid an FBI push against ShinyHunters following the group’s claimed breach of the bureau itself. The group said it entered FBI systems through an alleged Oracle PeopleSoft zero-day and stole 2TB to 3TB of data, a claim BleepingComputer says it has not independently verified; the FBI confirmed it was investigating but not that data was taken. A Dutch suspect, Pepijn van der Stap (“Umbreon”), was arrested on September 15. On the day Khader was reportedly detained, the group’s leak site went offline and its main spokesperson went quiet, although a new leak site appeared on Thursday. It is unclear whether those events are connected to the detention.
Rey has been tied to a string of breaches since 2025, including an early-2025 HellCat ransomware campaign, the Orange Romania incident, and the Jaguar Land Rover data leak, and was an administrator in “Scattered Lapsus$ Hunters” Telegram channels. In a late-2025 Krebs on Security profile, Krebs identified Rey as Khader. Khader reportedly told Krebs he had been cooperating with law enforcement since at least June. Neither Khader nor ShinyHunters has publicly commented on the Reuters report.
Sources
- Reuters: Key ShinyHunters hacker detained in Jordan is cooperating, sources say
- BleepingComputer: ShinyHunters hacker reportedly detained in Jordan, aiding FBI
- Krebs on Security: Dutch police arrest reformed hacker in ShinyHunters investigation
- Krebs on Security: Meet Rey, the admin of Scattered Lapsus$ Hunters