Jordanian authorities have detained a suspected member of the ShinyHunters extortion group known online as "Rey," and he is helping the FBI track down other members, Reuters reported, according to BleepingComputer. Reuters identified him as Saif al-Din Khader, and Jordanian state media Saturday quoted an official confirming an arrest without naming the suspect.

What Happened

People familiar with the matter told Reuters that Khader was taken into custody Tuesday, Sept. 29. They said he is cooperating with the FBI and other law enforcement agencies, including by giving investigators access to his electronic devices and digital correspondence to help identify co-conspirators. One source described his cooperation as critical to efforts to arrest the rest of the group.

The Jordanian official quoted by state media said investigations into the group and its affiliates are continuing. The FBI declined to comment on any arrest in Jordan but said it continues to aggressively investigate the recent cyber incident attributed to ShinyHunters.

RelatedIsraeli Ad Firm Turned Targeted Ads Into Zero-Click Spyware Delivery, Researchers Say

BleepingComputer noted that the ShinyHunters data leak site went offline Tuesday and the group's representatives stopped responding to reporters. A new leak site later appeared, suggesting other members are still operating.

Why It Matters

Rey is not a peripheral figure. Security journalist Brian Krebs reported in November 2025 that he was one of three administrators of Scattered Lapsus$ Hunters, a collective claiming to unite former members of Lapsus$, Scattered Spider and ShinyHunters, and that he had run the leak site for the HellCat ransomware operation and a version of BreachForums. BleepingComputer linked him to breaches at Telefónica, Orange and Jaguar Land Rover. Khader told Krebs at the time that he had been cooperating with police since at least June 2025.

An insider with administrator access and years of chat logs could give investigators a map of the group's infrastructure and membership. That matters for a crew that operates loosely across countries and has relied on members staying anonymous to one another.

The detention follows ShinyHunters' claim in September that it breached FBI systems through an alleged Oracle PeopleSoft zero-day and stole 2 to 3 terabytes of data, including personnel information. The FBI confirmed it was investigating unauthorized activity but did not confirm what was taken.

Earlier Arrest and FBI Pressure

Dutch police arrested a 24-year-old alleged member in Amsterdam on Sept. 15, a man identified in reports as Pepijn van der Stap and once known online as "Umbreon." As The Primary Wire reported Tuesday, a Rotterdam court ordered him held for at least 90 days, and police are separately examining material found on his laptop about two planned killings abroad.

After that arrest became public, FBI Cyber Division Assistant Director Brett Leatherman urged remaining members to turn themselves in, warning that the longer they stayed involved, the more the bureau would learn about them. Leatherman has said the group and its co-conspirators breached more than 140 organizations, often through third-party vendors and cloud platforms, and took at least $70 million in extortion payments.

What to Watch

Further arrests built on Khader's devices and communications would confirm how much his cooperation is worth to investigators. Other open questions are whether the U.S. seeks his extradition or a plea arrangement, whether Jordanian authorities release more detail on charges, and whether the new leak site continues to publish stolen data or fades as members go quiet.