ShinyHunters Suspect 'Rey' Reportedly Detained in Jordan

Suspected ShinyHunters Member Detained in Jordan

A man suspected of ties to the ShinyHunters data extortion group was reportedly taken into custody in Jordan on September 29, 2026, according to Reuters, which cited three people familiar with the matter. The report identifies the suspect by the online alias “Rey” and names him as Saif al-Din Khader. Reuters reported that Khader is reportedly cooperating with the U.S. Federal Bureau of Investigation (FBI) to help identify other members of the group. As of this writing, no U.S. or Jordanian government agency has issued a public statement confirming the detention or the cooperation, so these details should be treated as reported claims rather than confirmed fact.

ShinyHunters is a financially motivated hacking collective that security researchers have tracked since 2020. Rather than deploying ransomware to encrypt files, the group's documented pattern is to steal large volumes of customer or corporate data from a victim organization and then threaten to leak or sell it unless a ransom is paid, a tactic commonly called data extortion. The group has been associated in prior security reporting with breaches affecting large consumer brands and enterprise software customers, typically by compromising third-party platforms, cloud storage accounts, or customer relationship management (CRM) systems rather than attacking a target's own network directly.

Why a Suspect's Cooperation With the FBI Matters

If accurate, an alleged member cooperating with federal investigators would give the FBI insight into how ShinyHunters recruits members, launders extortion payments, and coordinates with other cybercriminal groups. Law enforcement agencies have used cooperating defendants in past cybercrime cases to build indictments against additional suspects, and the Department of Justice has pursued prior cases tied to large-scale data theft and extortion schemes. A single arrest, even with cooperation, does not typically shut down a collective like ShinyHunters. These groups tend to operate as loose, affiliate-style networks rather than a single hierarchical organization, meaning other members can continue operating independently of any one individual's legal status.

For readers tracking this story, the practical significance isn't the fate of one suspect. It's what a cooperating witness could reveal about the infrastructure, access brokers, and payment channels that extortion groups rely on, information that could inform future takedowns, sanctions, or indictments. Security teams should watch for follow-on reporting from the FBI, the Department of Justice, or Jordanian authorities confirming details, rather than treating this single, sourced report as the final word.

What This Means for Your Business

Healthcare practices, tax professionals, and small businesses are attractive targets for data extortion groups because they hold sensitive patient, financial, or tax records and often rely on third-party SaaS platforms for scheduling, billing, or customer support. A few concrete steps lower that exposure:

• Audit third-party and SaaS access. ShinyHunters-linked incidents have frequently traced back to compromised vendor portals, support desk credentials, or OAuth tokens rather than a direct network breach. Review which vendors can access your customer or patient data and whether that access is still needed.
• Require multi-factor authentication (MFA) on every administrative account, CRM login, and support portal, not just your primary email and VPN.
• Build an extortion response plan before you need one. Decide in advance how your organization will handle a ransom demand, including legal counsel involvement and whether you will negotiate, and avoid making that decision under pressure during an active incident.
• Report incidents promptly. The FBI's Internet Crime Complaint Center (IC3) accepts reports of extortion and data theft, and early reporting can support both your own recovery and broader law enforcement efforts against groups like ShinyHunters.
• Document any confirmed exposure. If patient or tax data is involved, maintaining clear records of what was accessed can simplify breach notification analysis under HIPAA or state data breach laws later, even before you know whether notification is legally required.

For broader guidance on preventing and responding to extortion-style incidents, the Cybersecurity and Infrastructure Security Agency (CISA) maintains the StopRansomware resource hub, which applies to data extortion as well as traditional ransomware cases.