Alleged ShinyHunters Hacker 'Rey' Detained in Jordan, Reportedly Cooperating With FBI
A man identified as Saif al-Din Khader, who used the online handle “Rey,” was detained in Jordan on October 3, according to BleepingComputer and other outlets citing people familiar with the matter. Investigators allege Khader held administrative access to Telegram channels run by “Scattered Lapsus$ Hunters,” a loosely organized collective whose members have claimed ties to the Lapsus$, Scattered Spider and ShinyHunters hacking groups, all of which have been linked to a wave of high-profile data-theft and extortion campaigns over the past two years.
According to the reports, Khader is cooperating with U.S. authorities, walking investigators through his devices and digital communications in an effort to help identify and locate other alleged members of the network. Sources described his cooperation as significant to ongoing efforts to build cases against additional suspects tied to the collective. Khader is alleged to have been involved in breaches of Telefonica’s internal Jira system in January 2025, Orange’s Romanian operations in February 2025, and the September 2025 cyberattack on Jaguar Land Rover that reportedly caused more than $220 million in losses, as well as a claimed theft of several terabytes of data from the FBI tied to an alleged Oracle PeopleSoft zero-day.
The detention follows the arrest of a separate alleged ShinyHunters leader, a 24-year-old man, in the Netherlands in late September; authorities there accused him of breaching more than 140 organizations and extorting roughly $70 million since 2025. Together, the two cases mark the most significant law-enforcement pressure yet on the extortion collective, which has built a reputation for large-scale breaches of corporate Salesforce and cloud environments at companies including Google, Cisco and PornHub.