An individual described as a leader of the ShinyHunters extortion group has been detained in Jordan and is cooperating with the FBI, according to Reuters, in a widening crackdown that federal officials say could bring more arrests.

Sources identified the suspect as Saif al-Din Khader, a teenager from Amman who goes by the handle "Rey" and is also a known member of the Scattered Lapsus$ Hunters crew. Reuters reported he is helping investigators identify and locate other ShinyHunters members; it is not clear where he is being held. FBI Director Kash Patel wrote on X that "more arrests are on the table."

The detention came shortly after the group hacked and defaced the FBI's jobs site, FBIJobs.gov, claiming to have stolen two to three terabytes of data. It circulated a sample list of 5,000 FBI employees while asserting it held personal and health information on all current and former employees. Khader reportedly pinned that hack on another suspect by leaving a defacement image of the Pokémon character Umbreon — the nickname used by Pepijn van der Stap, a Dutchman arrested in Amsterdam last week as part of the same FBI investigation. The FBI has said van der Stap was involved in hacking more than 140 organizations and collecting at least $70 million in extortion payments.

ShinyHunters rose to prominence through a string of high-profile data thefts and extortion campaigns against cloud and software vendors, and has been blamed for recent breaches affecting major enterprise systems. The arrests mark a rare coordinated strike by US and European authorities against a loosely organized group whose members operate across borders.

Sources