ShinyHunters hacker reportedly held in Jordan, helping the FBI

A member of the ShinyHunters extortion crew known online as Rey has reportedly been detained in Jordan, according to Reuters. Two sources say he was taken into custody on Tuesday and identified as Saif al-Din Khader.

The same sources say Khader is now helping the FBI and international law enforcement track down other members of the group. One described him walking investigators through his devices and digital communications to help identify and locate his alleged accomplices. "His cooperation is critical to ongoing efforts to arrest these hackers," a source told Reuters.

Against the backdrop of the FBI breach

The detention comes amid an FBI crackdown that followed a cyberattack on the bureau itself. In September, ShinyHunters told BleepingComputer it had breached FBI systems through an alleged Oracle PeopleSoft zero-day and then moved laterally into FBI-managed AWS GovCloud. The attackers claimed to have stolen between 2 and 3 TB of data, including information on current and former employees, applicants, and medical records. BleepingComputer could not independently verify the claims; the FBI confirmed only that it was investigating.

Earlier, on September 15, Dutch police arrested a 24-year-old Amsterdam man whom journalists tied to the alias Umbreon. The FBI then publicly urged the group's remaining members to turn themselves in. "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left," Cyber Division Assistant Director Brett Leatherman said last week. "I suggest you reach out first while the choice is still yours."

Signs of disruption

The same Tuesday, cracks appeared in the operation: an affiliate abruptly shut down their account, the group's leak site went offline, and its main representative stopped answering the press. Whether the silence is tied to Khader's detention is unclear. Yet by Thursday a new leak site had appeared, suggesting others still run the operation.

The Rey persona has been linked to a string of attacks over the past two years — the breach of Telefónica's Jira system, the Orange Romania leak, and intrusions at Jaguar Land Rover. Rey was also associated with Scattered Lapsus$ Hunters, a group said to comprise former members of Lapsus$, Scattered Spider, and ShinyHunters. In November 2025, journalist Brian Krebs, citing infostealer logs and direct Signal conversations, identified Rey as Saif al-Din Khader. Krebs said Khader claimed to have been cooperating with law enforcement since at least June and had "told them nearly everything" — claims the journalist could not verify.

Source: Bleeping Computer