Threat Intelligence

ShinyHunters Suspect 'Rey' Reportedly Detained in Jordan as FBI Pursues More Arrests

The Hacker News · 4 Oct 2026

Key Takeaway Arrests do not end the threat from groups like ShinyHunters, so keep software patched, especially web-facing systems and content management platforms, and review what sensitive data you store online.

A suspected member of the ShinyHunters extortion group, who uses the alias "Rey", has reportedly been detained by authorities in Jordan, according to Reuters, which cited three people familiar with the matter. His name is said to be Saif al-Din Khader, and he was reportedly taken into custody on September 29, 2026. He is said to be cooperating with the FBI to identify other group members. One source told the news agency: "His cooperation is critical to ongoing efforts to arrest these hackers."

Rey, also known as ReyXBF, was previously named by journalist Brian Krebs in November 2025 as one of three administrators of Scattered LAPSUS$ Hunters, a group assessed to combine Scattered Spider, LAPSUS$ and ShinyHunters. Krebs noted he had earlier run the data leak site for the Hellcat ransomware group and later administered the latest version of BreachForums. Khader also told Krebs he had been cooperating with law enforcement since at least June 2025.

The news follows the arrest last week of a 24-year-old man in Amsterdam linked to the group's operations. Independent reports named him as Pepijn van der Stap, though a ShinyHunters spokesperson denied any connection. FBI director Kash Patel said "More arrests are on the table." The group has also been in the spotlight for hijacking the Cl0p darknet site through an unpatched flaw in Grav CMS, and for a hack of an FBI jobs portal that reportedly exposed around three terabytes of data.

ShinyHunters Law Enforcement Data Extortion Scattered LAPSUS$ Hunters Patching

Primary source @FBIDirectorKash on X -> @FBIDirectorKash on X ->

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.