Alleged ShinyHunters figure detained in Jordan, reportedly aiding FBI

Jordan detained alleged ShinyHunters figure Saif al-Din Khader, reportedly cooperating with the FBI, amid an unverified FBI jobs-portal breach and a separate Dutch arrest.

Jordanian authorities detained Saif al-Din Khader, known as Rey or ReyXBF, a suspected ShinyHunters figure described variously as a member, technical operator, or teenage leader from Amman; The Hacker News dates the detention to September 29, 2026, The Record cites FBI sources for September 28, and Malwarebytes says Reuters reported the 16-year-old is in FBI custody even as Help Net Security says Reuters could not confirm where he is held and earlier copy said the FBI had not confirmed the arrest. He is reportedly cooperating by showing investigators his devices and communications to identify other members, and The Hacker News says he told Krebs he had assisted law enforcement since at least June 2025. Dutch police arrested 24-year-old Amsterdam resident Pepijn van der Stap, alias Umbreon, on September 15, with Security Affairs saying he was due in Rotterdam District Court and the group denying a link; The Register says the FBI confirmed multiple related arrests, sources disagree on whether more than 140 breached organizations and at least $70 million refer to the crew or to van der Stap, and Director Kash Patel said further arrests are possible. Accounts of the FBI jobs-portal incident also conflict: several outlets treat the claimed Oracle PeopleSoft zero-day and AWS GovCloud theft of 2–3 terabytes as unverified and say the FBI has not confirmed a theft, while The Record says the FBI is investigating exposure of SSNs, addresses, phones, and IDs for nearly every agent plus task-force officers, and Krebs identifies CVE-2026-35273, mass-exploited since June via an Accenture-run site, with records on more than 5,000 personnel. Krebs adds that the group was extorting Boeing spin-off Jeppesen ForeFlight, sold to Thoma Bravo for $10.55 billion in November 2025, which Boeing is reviewing; the leak site went offline then reappeared, the group resurfaced on Telegram, and reporting also ties activity to Jaguar Land Rover, Cl0p/Clop sites, and victims including Kodak, McKesson, and Instructure.

• Saif al-Din Khader (Rey or ReyXBF), described as a 16-year-old from Amman, was detained in Jordan; reports date it September 29, 2026, or September 28 per The Record’s FBI sources, and disagree on whether the FBI or Reuters confirmed his…
• He is reportedly cooperating with the FBI, including walking investigators through devices and messages; The Hacker News says he told Brian Krebs he had assisted law enforcement since at least June 2025.
• Dutch police arrested 24-year-old Pepijn van der Stap (Umbreon) in Amsterdam on September 15; ShinyHunters denied a connection, and Security Affairs said he was due in Rotterdam District Court.
• The FBI told The Register that partners made multiple arrests, and Director Kash Patel said more are possible; outlets disagree on whether more than 140 organizations and at least $70 million describe the crew or van der Stap.
• Breach accounts conflict: unverified claims cite an Oracle PeopleSoft zero-day (Krebs: CVE-2026-35273, exploited since June) against FBIJobs.gov and AWS GovCloud and 2–3 TB stolen, while exposure figures range from a ~5,000-person sample…
• Krebs says the group was extorting Boeing unit Jeppesen ForeFlight, sold to Thoma Bravo for $10.55 billion in November 2025; Boeing is reviewing the claims.
• The leak site went offline around the detention and a replacement appeared Thursday; the group later resurfaced on Telegram.
• Reporting also links the activity to Scattered LAPSUS$ Hunters, HellCat, BreachForums, the August 2025 Jaguar Land Rover breach, Cl0p/Clop site incidents, and victims including Kodak, McKesson, and Instructure.