Reported by 11 outlets
ShinyHunters hacker “Rey,” allegedly involved in FBI data theft, detained in Jordan
Why this score
- Breadth
- 2.00 / 2.0 · 11 sources
- Authority
- 2.00 / 2.0 · best outlet weight
- Severity
- 1.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.23 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The suspected leader of ShinyHunters, Saif al-Din Khader, known as "Rey," a teenage cybercriminal from Amman, was arrested in Jordan and is reportedly cooperating with the FBI, per Reuters sourcing. Khader is also a known member of Scattered Lapsus$ Hunters. His detention followed the group's hack and defacement of FBIJobs.gov, where ShinyHunters boasted of stealing 2 to 3 terabytes of data and sent media a sample list of 5,000 FBI employees, claiming to hold personal and health information on all current and former FBI employees.
The arrest lands a week after Dutch police detained a 24-year-old from Amsterdam in the FBI's ShinyHunters investigation. The FBI said that suspect took part in hacking more than 140 organizations and collecting at least $70 million in extortion payments; independent reporting identifies him as Pepijn van der Stap, convicted in 2023 for hacking and extortion and on supervised release. Khader apparently tried to pin the FBIJobs.gov defacement on van der Stap, a sign of internal friction as the group's leadership is dismantled.
A talking detainee with admin-level knowledge could expose infrastructure, affiliate identities, and victim lists. The group's earlier operations included exploitation of Oracle PeopleSoft zero-day CVE-2026-35273 before Oracle's June 10 advisory, so its access inventory is broad.
Watch for confirmations of where Khader is held, charges in the US or Jordan, whether the FBI employee data surfaces on leak markets despite his cooperation, and further arrests flowing from his debriefing. Organizations with ShinyHunters-related exposure should rotate credentials and monitor leak sites.
Timeline
-
original reporting
ShinyHunters hacker “Rey,” allegedly involved in FBI data theft, detained in Jordan
malware.news · 10d ago · October 3rd, 2026
Jana Winter, Raphael Satter, and A.J. Vicens report: A key member of the ShinyHunters hacking group, which claims to have stolen data on every FBI employee, was detained this week in Jordan, three people familiar with the matter told Reuters. Two of the sources said he was cooperating with the FBI to identify his fellow… Source Article Link: ShinyHunters hacker "Rey," allegedly involved in FBI data theft, detained in Jordan - DataBreaches.Net
-
update from thehackernews.com
ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Trigger Extortion
thehackernews.com · 124d ago · June 11th, 2026
Reported that ShinyHunters exploited the Oracle PeopleSoft zero-day CVE-2026-35273 before Oracle's June 10 advisory, using it for data theft and extortion. This places the group's PeopleSoft operation roughly four months before its September claim of breaching the FBI.
-
update from esentire.com
Oracle PeopleSoft Zero-Day Vulnerability (CVE-2026-35273) Exploited by ShinyHunters | eSentire
esentire.com · 123d ago · June 12th, 2026
Vendor-side advisory noting Oracle disclosed a critical unauthenticated remote code execution vulnerability in Oracle PeopleSoft PeopleTools on June 10, 2026, tracked as CVE-2026-35273 with a CVSS score of 9.8, and already exploited by ShinyHunters.
-
update from bleepingcomputer.com
ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach
bleepingcomputer.com · 21d ago · September 22nd, 2026
ShinyHunters told BleepingComputer it used the PeopleTools zero-day for remote code execution on the night of Monday, September 21, reached FBI-managed AWS GovCloud infrastructure, and stole a claimed 2TB to 3TB covering current and former employees, job applicants, and internal records. The group also claimed compromise of FBI Criminal Justice, HR, and Medlink services, and said it was exploiting the same flaw against Fortune 500 companies.
-
update from thehackernews.com
ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants
thehackernews.com · 20d ago · September 23rd, 2026
Covered the group's claim that it breached the FBI and stole employee data, with the bureau stating it was investigating unauthorized activity affecting FBIjobs.gov, its recruitment portal.
-
update from cbsnews.com
Cybercriminal group claims it stole FBI personnel and applicant data
cbsnews.com · 20d ago · September 23rd, 2026
CBS News reported the group's claim, made in posted communications, that it breached the FBI on Monday and stole data about personnel and job applicants. Early mainstream confirmation that the claim predates the October detention reporting.
-
update from cloud.google.com
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
cloud.google.com · 17d ago · September 26th, 2026
Mandiant and Google Threat Intelligence Group reported renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), after the June zero-day window of May 27 to June 9, 2026 that hit higher education hardest. The actor bypassed WAF rules blocking the Environment Management Hub endpoint by URL-encoding a single character, requesting /%50SEMHUB/ instead of /PSEMHUB/, and the renewed wave spans higher education, technology, IT services, healthcare, agriculture, transportation, and government.
-
update from www.reuters.com
Reuters: ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau, sources say # cybersecurity # infosec https://ww
www.reuters.com · 10d ago · October 3rd, 2026
Reuters: ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau, sources say # cybersecurity # infosec https://ww
via Mastodon https://www.reuters.com/world/middle-east/key-shinyhunters-hacker-detained-jordan-is-cooperating-sources-say-2026-10-03/
-
mentioned by reuters.com
ShinyHunters hacker in FBI data theft detained in Jordan
reuters.com · 10d ago · October 3rd, 2026
-
update from bleepingcomputer.com
ShinyHunters hacker reportedly detained in Jordan, aiding FBI
bleepingcomputer.com · 10d ago · October 3rd, 2026
A suspected ShinyHunters hacking group member known online as "Rey" has reportedly been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group. According to Reuters, Jordanian authorities detained Rey, identified as Saif al-Din Khader, this week, with two sources saying he was taken into custody on Tuesday. Two sources familiar with the arrest told Reuters that Khader is now helping the FBI and international law enforcement agencies locate other group members. One source said Khader is walking law enforcement through his electronic devices and digital communications to help identify and locate his alleged co-conspirators. "His cooperation is critical to ongoing efforts to arrest these hackers," a source told Reuters . The reported detention comes amid an FBI crackdown on ShinyHunters following the group's cyberattack on the bureau. The threat actors claimed they stole between 2TB and 3TB of data, including information belonging to current and former FBI employees, job applicants, medical and psychiatric information, and records from internal services. BleepingComputer has not independently verified the alleged zero-day, lateral movement, or volume of stolen data. The FBI previously confirmed that it was investigating claims of una
-
mentioned by www.bleepingcomputer.com
🤖 ShinyHunters member "Rey" reportedly detained in Jordan and cooperating with the FBI, walking investigators through his devices to identif
www.bleepingcomputer.com · 10d ago · October 3rd, 2026
-
update from www.reuters.com
By now, many of you may have already read the news that Saif al-Din Khader, aka “Rey” and “Hikki-Chan,” has been arrested in Jordan. Alleged
www.reuters.com · 10d ago · October 3rd, 2026
By now, many of you may have already read the news that Saif al-Din Khader, aka “Rey” and “Hikki-Chan,” has been arrested in Jordan.
-
update from hackread.com
ShinyHunters: alleged member Rey detained in Jordan over FBI data theft case
hackread.com · 10d ago · October 3rd, 2026
ShinyHunters, the collective linked to massive breaches (Snowflake, Ticketmaster and others), has one of its alleged members, "Rey", detained in Jordan and cooperating in connection with the FBI data theft case.
-
mentioned by radar.offseq.com
ShinyHunters threat actor faces HIGH-severity disruption: suspected member Rey detained in Jordan, cooperating with FBI. Group linked to Saa
radar.offseq.com · 10d ago · October 4th, 2026
-
mentioned by thehackernews.com
🤖 A suspected ShinyHunters member known as "Rey" (Saif al-Din Khader) was reportedly detained in Jordan on Sept 29 and is cooperating with t
thehackernews.com · 9d ago · October 4th, 2026
-
mentioned by thehackernews.com
🤖 ShinyHunters suspect "Rey" (Saif al-Din Khader) reportedly detained in Jordan since Sep 29, now cooperating with the FBI to identify other
thehackernews.com · 9d ago · October 5th, 2026
-
update from securityweek.com
Alleged ShinyHunters Leader Arrested in Jordan
securityweek.com · 8d ago · October 5th, 2026
Khader is also a known member of the Scattered Lapsus$ Hunters group. It is unclear where he is detained. The arrest was made shortly after the extortion group hacked and defaced the FBI’s jobs site , FBIJobs.gov, boasting about stealing 2-3 terabytes of data. ShinyHunters sent a sample list of 5,000 FBI employees to the media, claiming to be in possession of the personal and health information of all current and former FBI employees. Last week, the Dutch police announced the arrest of a 24-year-old man from Amsterdam as part of the FBI’s investigation into ShinyHunters. The FBI later confirmed the arrest , saying the individual was involved in the hacking of more than 140 organizations, as well as in collecting at least $70 million in extortion payments. While the Dutch police and the FBI refrained from revealing the suspect’s identity, independent reports have suggested he is Pepijn van der Stap, who was convicted in 2023 for hacking and extorting numerous organizations and was on supervised release after serving three years in prison. Khader apparently pinned the recent FBI hack on van der Stap by placing a defacement image featuring t
-
update from radar.offseq.com
HIGH severity: ShinyHunters’ alleged leader arrested in Jordan after FBIJobs.gov breach. Group hit 140+ orgs, stole sensitive data, and exto
radar.offseq.com · 8d ago · October 5th, 2026
HIGH severity: ShinyHunters’ alleged leader arrested in Jordan after FBIJobs.gov breach.