Saif al-Din Khader, a suspected ShinyHunters member allegedly known as Rey, was detained in Jordan and is helping investigators locate fellow hackers, Reuters reported on October 3, 2026. Three sources described the detention; two said he was cooperating with the FBI. The report marks a new development in the investigation of the data-theft and extortion group.

Reuters could not establish the circumstances of the detention or Khader's current whereabouts. The FBI declined to discuss a specific arrest abroad but said its investigation continued and that partners had helped arrest multiple suspects. Separately, the bureau has confirmed a Dutch arrest involving an alleged ShinyHunters leader, linking that suspect and co-conspirators to more than 140 organizational breaches and at least $70 million in alleged extortion payments since last year.

FBI Cyber Division Assistant Director Brett Leatherman said the group often targets third-party vendors in cloud platforms, steals sensitive information and threatens publication to demand payment. These are the bureau's descriptions of the broader operation; they do not establish the entry point used in the recent incident involving FBI systems.

BleepingComputer reported that ShinyHunters claimed responsibility for an FBI intrusion, but said it had not independently verified the alleged vulnerability, lateral movement or volume of stolen data. Its October 3 report also described a new ShinyHunters leak site appearing on Thursday. The outlet said any connection between earlier infrastructure shutdowns and Khader's reported detention remained unclear.

The FBI's May advisory on ShinyHunters warns that exposed cloud management platforms and integrated third-party services can put educational institutions at elevated risk. It says stolen information can support targeted phishing and impersonation. The advisory also cautions that extortionists may exaggerate their access or make false claims about sensitive material to pressure victims.

For people contacted with data-theft threats, the FBI recommends verifying unusual requests through known contact channels, avoiding unexpected links and attachments, and declining payment demands. It urges reporting suspected ShinyHunters intrusions to IC3 or a local FBI office and retaining incident details. Reuters' account of cooperation remains attributed to sources, while the bureau has not publicly confirmed this specific detention.