Back to Feed
Threat IntelligenceOct 5, 2026

Alleged ShinyHunters Leader Arrested in Jordan

Alleged ShinyHunters leader arrested in Jordan, cooperating with FBI.

An individual identified as Saif al-Din Khader, known as Rey and believed to be the leader of the ShinyHunters extortion group, has been arrested in Jordan. He is reportedly cooperating with the FBI to identify other group members. This arrest follows a recent hack of the FBI's jobs site, where ShinyHunters claimed to steal terabytes of data and personal information of FBI employees. The FBI also confirmed a separate arrest in Amsterdam related to the group's activities, involving over 140 organizations and $70 million in extortion.

AI summary of the linked source. Not reviewed by an editor. How this works

Vendor Watch

Run FBI?

Get an email when a new story names FBI, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy

The lesson from this incident

Full lesson

The ShinyHunters group exploited weak access controls and security gaps across more than 140 organizations, stealing terabytes of sensitive data — including from the FBI's own infrastructure — and extorting $70 million. The root cause spans inadequate access control mechanisms, insufficient data protection practices, and delayed incident response that allowed the group to operate at scale for an extended period. The breach of the FBI's jobs site is particularly alarming, demonstrating that even high-profile government agencies are not immune to credential theft and unauthorized access. This case underscores that extortion groups thrive when organizations fail to layer defenses, monitor for anomalous access, and rapidly contain breaches before data exfiltration occurs.

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

  • domain — FBIJobs.gov

Entities

ShinyHunters (threat_actor)Scattered Lapsus$ Hunters (threat_actor)Rey (threat_actor)Umbreon (threat_actor)Umbreon (product)FBI (vendor)