ShinyHunters: Jordan detains Saif al-Din Khader (“Rey”); sources say cooperating with FBI after alleged FBI data theft
Reuters (3 October 2026; Jana Winter / Raphael Satter / AJ Vicens) reports Jordanian authorities detained Saif al-Din Khader — alleged ShinyHunters / Scattered Lapsus$ Hunters handle “Rey” (also “Hikki-Chan”) — this week; two of three sources said custody began Tuesday (~30 Sep). Two sources say he is cooperating with the FBI and international partners to locate other group members, including walking investigators through devices and digital communications. Reuters could not determine detention circumstances or current whereabouts; attempts to reach Khader/family unsuccessful. FBI declined to comment on any specific arrest abroad but said it “continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects.” Context: group’s claimed FBI PeopleSoft / AWS GovCloud intrusion (desk shinyhunters-fbi-peoplesoft-20260922); Dutch detention of Pepijn van der Stap / Umbreon (desk shinyhunters-dutch-arrest-20260928). BleepingComputer (3 Oct) amplifies: temporary DLS/messaging disruption mid-week then a new leak site online Thursday; main ShinyHunters channel stopped answering media. Krebs (Nov 2025) had previously identified Khader as Rey and quoted him claiming prior law-enforcement contact — treat as background, not confirmation of this week’s custody terms. Distinct LE action from the Dutch arrest card. Primary: Reuters exclusive 3 Oct (StreetInsider/syndicate mirror); wire: BleepingComputer 3 Oct.
- Product
- ShinyHunters / Scattered Lapsus$ Hunters extortion activity (law-enforcement action; not a product CVE)
- Versions
- n/a
- Exploited in Australia?
- unknown
- Patch to
- No product patch from the Jordan detention. Continue PeopleSoft EMHub patching/disablement (CVE-2026-35273), SaaS/SSO vendor hardening, and monitoring of ShinyHunters leak/extortion channels. Watch FBI/Jordanian charging detail and any further arrests alongside the Dutch Umbreon case.
Primary: Reuters (via StreetInsider) — ShinyHunters Rey / Saif al-Din Khader detained in Jordan; FBI cooperation (3 Oct 2026) · Vendor: BleepingComputer — ShinyHunters hacker reportedly detained in Jordan, aiding FBI (3 Oct 2026) · Cyberstack desk — related Dutch Umbreon / Pepijn van der Stap detention (28–29 Sep 2026)