Home · Wiki · Incidents & Campaigns
type: incident · created: 2026-10-04 · updated: 2026-10-04 · tags: [incident, government, zero-day] · confidence: medium · severity: high · affected_sectors: [government] · au_impact: false

A suspected member of the ShinyHunters extortion group, known online as "Rey" and identified by Reuters as Saif al-Din Khader, has reportedly been detained in Jordan and is now cooperating with the FBI and international law enforcement to help locate other group members. Two sources told Reuters that Jordanian authorities took Khader into custody early in the week beginning Monday 28 September, and that he is walking law enforcement through his electronic devices and digital communications to identify alleged co-conspirators; one source said his cooperation is "critical to ongoing efforts to arrest these hackers". The detention follows ShinyHunters' September claim that it breached FBI systems using an alleged Oracle PeopleSoft zero-day and spread into the bureau's AWS GovCloud, claiming 2–3TB of stolen data — a claim the FBI would only confirm it was investigating. It also follows the Dutch police's 15 September arrest of a 24-year-old Amsterdam man in the same investigation. BleepingComputer has not independently verified the alleged zero-day, lateral movement, or volume of data.

Attribute Detail
Sector Government
Date 2026-10-04
Source BleepingComputer
Reliability Tier 2