[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fi9zR1huEXCrHI94hRxq6q4Zu-Lw8tJ6-mbMobrJ38O8":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":58},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f49e4282-950c-40c9-8a88-a0e577acd6db","Alleged ShinyHunters Leader Arrested in Jordan","alleged-shinyhunters-leader-arrested-in-jordan-688896","Known as Rey, the suspect is reportedly helping the FBI identify and locate other members of the extortion group. The post Alleged ShinyHunters Leader Arrested in Jordan appeared first on SecurityWeek.","An individual identified as Saif al-Din Khader, known as Rey and believed to be the leader of the ShinyHunters extortion group, has been arrested in Jordan. He is reportedly cooperating with the FBI to identify other group members. This arrest follows a recent hack of the FBI's jobs site, where ShinyHunters claimed to steal terabytes of data and personal information of FBI employees. The FBI also confirmed a separate arrest in Amsterdam related to the group's activities, involving over 140 organizations and $70 million in extortion.","Alleged ShinyHunters leader arrested in Jordan, cooperating with FBI.","https:\u002F\u002Fwww.securityweek.com\u002Falleged-shinyhunters-leader-arrested-in-jordan\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F06\u002Fhacker-arrested.jpeg","2026-10-05T07:16:53+00:00","2026-10-05T08:00:12.599892+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":19},"Scattered Lapsus$ Hunters",{"name":23,"type":19},"Rey",{"name":25,"type":19},"Umbreon",{"name":25,"type":27},"product",{"name":29,"type":30},"FBI","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},[50],{"type":51,"value":52,"context":53},"domain","FBIJobs.gov","FBI jobs site allegedly hacked and defaced by ShinyHunters.",[29,25],{"controls":56,"vendors":57},[],[],{"slug":59,"title":60,"body":61,"framework_refs":62,"framework_notes":75},"shinyhunters-leader-arrested-after-70m-extortion-spree-targeting-140-organizations","ShinyHunters Leader Arrested After $70M Extortion Spree Targeting 140+ Organizations","The ShinyHunters group exploited weak access controls and security gaps across more than 140 organizations, stealing terabytes of sensitive data — including from the FBI's own infrastructure — and extorting $70 million. The root cause spans inadequate access control mechanisms, insufficient data protection practices, and delayed incident response that allowed the group to operate at scale for an extended period. The breach of the FBI's jobs site is particularly alarming, demonstrating that even high-profile government agencies are not immune to credential theft and unauthorized access. This case underscores that extortion groups thrive when organizations fail to layer defenses, monitor for anomalous access, and rapidly contain breaches before data exfiltration occurs.",[63,64,65,66,67,68,69,70,71,72,73,74],"CIS Control 5 – Account Management","CIS Control 3 – Data Protection","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IR-4 (Incident Handling)","NIST SP 800-53 SI-4 (Information System Monitoring)","NIST CSF DE.CM-1 (Continuous Monitoring)","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","ITIL Service Security Management – Incident and Problem Management","MITRE ATT&CK T1078 – Valid Accounts","MITRE ATT&CK T1486 – Data Encrypted for Impact",{}]