FBI Confirms Multiple Arrests in ShinyHunters Data-Theft Investigation

The FBI has told The Register that it and its law enforcement partners have arrested "multiple" suspects in an investigation into a September hack allegedly involving the data-theft-and-extortion group ShinyHunters. An FBI spokesperson said the bureau "will spare no resource" in bringing those responsible to justice. The FBI declined to comment on individual arrests.

Reuters has reported that one suspect, Saif al-Din Khader, who goes by the alias Rey, was detained in Jordan on September 29 and is said to be cooperating with the FBI to identify other group members. Khader previously confirmed his identity to journalist Brian Krebs, who described him as the "technical operator and public face" of Scattered LAPSUS$ Hunters. Researcher Kevin Beaumont said Rey was one of those who got into Jaguar Land Rover (JLR). ShinyHunters did not respond to The Register's questions.

The JLR breach in late August 2025 hit the carmaker's IT systems and halted manufacturing. Dealer systems went down, suppliers faced cancelled or delayed orders, and payroll data belonging to thousands of employees was stolen. The attack was attributed to Scattered LAPSUS$ Hunters and described as one of the most costly in UK history. Two weeks before Khader's detention, Dutch police arrested a 24-year-old the FBI called one of the alleged leaders of ShinyHunters. Krebs and other reports identify him as Pepijn van der Stap, who was convicted in 2023 of hacking and extortion.