ShinyHunters Suspect Reportedly Detained in Jordan and Helping FBI

Jordanian authorities have reportedly detained a ShinyHunters suspect who may be helping investigators identify other members of the cybercrime group. Sources familiar with the case identified him as Saif al-Din Khader, known online as “Rey.”

According to those sources, authorities took Khader into custody on Tuesday. He is reportedly assisting the FBI and international investigators by reviewing his devices and online communications.

However, the available account relies on source testimony rather than a public announcement confirming the details of his cooperation.

Reported Detention Coincides With Disruption to Group Activity

Several changes to ShinyHunters’ online activity emerged around the time of the reported detention.

An alleged affiliate abruptly closed a messaging account previously used to discuss the group’s attacks. Meanwhile, its data leak website went offline, and its main representative stopped answering media questions.

Nevertheless, no confirmed evidence connects those developments to Khader’s reported detention.

By Thursday, a replacement leak website had appeared. That suggests people associated with the operation remained active despite the disruption.

FBI Investigation Follows Claims of Stolen Bureau Data

The case comes as investigators pursue ShinyHunters following its claims of an intrusion into FBI systems.

In September, the group claimed it exploited a previously unknown Oracle PeopleSoft vulnerability. It also alleged that it subsequently accessed AWS GovCloud environments managed by the bureau.

The attackers claimed to have taken between two and three terabytes of information. Their account described employee records, applicant details, medical information and data from internal services.

However, the alleged vulnerability, access route and volume of stolen information remain unverified. The FBI acknowledged investigating claims of unauthorized activity but did not confirm data theft.

Separately, Dutch police arrested a 24-year-old Amsterdam man on September 15 during an investigation into ShinyHunters. Subsequent reporting identified him as Pepijn van der Stap, previously known online as “Umbreon.”

After that arrest, the FBI urged other members to surrender. The bureau said investigators continued identifying participants through cooperation and seized infrastructure.

Rey Has Links to Earlier Data Theft Cases

The ShinyHunters suspect has also appeared in reporting about earlier attacks associated with the HellCat ransomware operation.

In January 2025, Rey joined three other attackers in claiming responsibility for accessing Telefónica’s internal Jira system. They alleged that they stole approximately 2.3GB of documents and other records.

Later, Orange confirmed a cyberattack affecting its Romanian operations after Rey published roughly 6.5GB of data. At the time, he claimed HellCat membership but said he conducted that attack independently.

Rey also had reported links to a March 2025 Jaguar Land Rover breach involving source code, employee information and development records.

Additionally, accounts associated with Rey held administrative privileges in Telegram channels run by Scattered Lapsus$ Hunters. That collective claimed to include former participants from several hacking groups.

However, those connections do not establish his involvement in every attack the collective claimed.

Earlier Cooperation Claims Remain Unverified

Khader had claimed contact with law enforcement before his reported detention.

In a November 2025 account, he said he had spoken with investigators since at least June of that year. He also claimed he was distancing himself from Scattered Lapsus$ Hunters.

Those statements could not be independently verified at the time.

For now, the extent of his reported assistance remains unclear. Meanwhile, the replacement leak site suggests the latest developments have not ended the ShinyHunters operation.