A ShinyHunters Hacker Detained in Jordan Is Reportedly Walking the FBI Through His Devices to Find His Crew

One of the alleged key members of ShinyHunters, the extortion crew that claims it broke into the FBI, has reportedly been detained in Jordan. And he may now be helping the Bureau track down everyone else.

Saif al-Din Khader, the hacker known as "Rey," was detained by Jordanian authorities on Tuesday, 29 September, three people familiar with the matter told Reuters. Two of them said he is cooperating with the FBI and international law enforcement. One said he is walking investigators through his electronic devices and digital communications to identify his alleged co-conspirators.

"His cooperation is critical to ongoing efforts to arrest these hackers," one source said. Khader has not been publicly charged, and the FBI has not confirmed his arrest.

A gang that went after the FBI

The Bureau declined to comment on any specific arrest abroad. It said it "continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects, and we will spare no resource in bringing each of the responsible individuals to justice."

That incident is personal. In September, ShinyHunters claimed it got into the FBI through the apply.fbijobs.gov jobs portal using an Oracle PeopleSoft flaw, the same bug the group has been mass-exploiting by slipping past WAF rules. From there, it said, it moved into FBI-managed AWS GovCloud systems and walked off with 2TB to 3TB of data on current and former employees and job applicants, including medical and psychiatric records. The FBI confirmed it was investigating unauthorized activity but has not confirmed the volume. Reuters reviewed samples containing personal details, job roles and psychiatric information.

The FBI says the group and its co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments.

The net tightens

On 15 September, Dutch police arrested a 24-year-old Amsterdam man, identified by KrebsOnSecurity and DataBreaches as Pepijn van der Stap, or "Umbreon." The FBI called him an alleged leader. ShinyHunters denied any link.

FBI Cyber Division Assistant Director Brett Leatherman then sent a message to whoever was left. "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left," he said. "You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours."

The same Tuesday Khader was detained, the group's journalist-facing account went silent. By Wednesday its dark web leak site was offline, which operators blamed on rival sabotage and an unrelated disruption. A new ShinyHunters leak site came online Thursday, a sign that someone is still running the show, according to BleepingComputer.

Rey has said this before

Khader is not new to the spotlight. In November 2025, Brian Krebs identified Rey as a teenager from Amman using infostealer logs and a Signal conversation. Rey had been an admin of the Hellcat ransomware leak site and of Scattered LAPSUS$ Hunters Telegram channels, and was linked to the January 2025 Telefonica Jira breach and a roughly 6.5GB leak from Orange Romania that February.

Back then, he told Krebs something that now sounds very different: "I'm already cooperating with law enforcement. In fact, I have been talking to them since at least June." Krebs could not verify it.

What Khader has actually handed over, whether he will be charged, and whether Jordan will extradite him are all still unknown.