MediumII Cyber Warfare & Critical Infrastructure3 October 2026, Saturday
ShinyHunters member Rey detained in Jordan and helping the FBI
Saif al-Din al-Khader, the ShinyHunters member known as 'Rey', has been detained in Jordan and is cooperating with the FBI, Reuters reported on 3 October, citing 2 sources. The group claimed in September to have stolen 2–3 TB of data from the FBI.
According to the Reuters report cited by The New Arab, Khader was detained by Jordanian authorities on Tuesday 29 September. According to BleepingComputer on 3 October, Khader is helping investigators track down other group members by going through his electronic devices and correspondence with them. As of 3 October, Reuters could not verify Khader's whereabouts or the conditions of his detention. The FBI said it had arrested more than 1 suspect together with its partners, but gave no exact number.
On 22 September ShinyHunters claimed to have taken 2–3 TB of staff and applicant data by exploiting an unpatched flaw in the Oracle PeopleSoft system behind the FBI's job application portal. The group alleges it stole data on every FBI employee without exception. According to BleepingComputer, Rey is linked to the leak of 2.3 GB of data from Telefónica's Jira system in January 2025 and to the leadership of an umbrella group called Scattered Lapsus$ Hunters.
The September 2025 attack on Jaguar Land Rover, claimed by the same umbrella group, cost the carmaker more than $220 million. According to The New Arab, the incident is being compared with the 2015 OPM breach, attributed to China, which exposed security clearance data on millions of Americans.
Talay assessment
Bottom line
The detention came just 7 days after the FBI breach and shows law enforcement reaching the core of ShinyHunters. If Rey's cooperation is confirmed, rapid progress can be expected on the group's other members and on the fate of the 2–3 TB of data. Even so, the group's dispersed structure means a single detention will not end the data leak threat; a retaliatory data dump remains a near-term risk.
Likely effects
- US public institutionsNegative1–6 months
If the leaked FBI data is published, it will cause lasting damage to personnel security and counter-intelligence.
- Corporate ransom and extortion riskPositiveWeeks
Detaining core members could slow the wave of attacks exploiting the PeopleSoft flaw in the near term.
- Data security at Turkish institutionsUncertainWeeks
The group's targeting of enterprise software such as PeopleSoft raises the patching priority for Turkish companies and universities running the same software.
Possibilities, ranked
- 1More detentions follow50%
Information from Rey leads to further detentions in other countries within a few weeks.
Watch: A new ShinyHunters-linked arrest announced by the Justice Department or Europol
- 2The group retaliates35%
Remaining members publish part of the FBI data on their leak site.
Watch: ShinyHunters posting FBI data on its leak site
- 3The report is denied15%
Jordan or Khader's relatives deny the detention or the cooperation claim.
Watch: An official statement from Jordanian authorities
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Data allegedly stolen from the FBI▼ 2–3 TB
- Telefónica Jira leak▼ 2.3 GB
- Cost of the JLR attack▼ $220m+