Suspected ShinyHunters Hacker Detained in Jordan Is Cooperating With FBI

A suspected member of the ShinyHunters cybercrime group known online as Rey has been detained in Jordan, Reuters and BleepingComputer reported. Two sources familiar with the matter told Reuters that Jordanian authorities took Saif al-Din Khader into custody on Tuesday. [1][3]

The sources told Reuters that Khader is now assisting the Federal Bureau of Investigation and international law enforcement agencies. According to BleepingComputer and Reuters, he is aiding investigators to locate other members of the extortion group following a probe into data theft. [1][3]

ShinyHunters started its activities in May 2020 by claiming the theft of 91 million user records from Tokopedia and 271 million records from Wattpad. These early security breaches frequently involved the exploitation of unsecured cloud storage systems and GitHub repositories. [10]

The hacking collective later adopted voice phishing tactics to impersonate information technology staff and obtain administrative credentials. These operations included a claimed breach of AT&T for 70 million records in 2022 and an attack on Pizza Hut Australia in 2023 affecting 30 million customers. The group also focused on enterprise cloud applications, particularly Salesforce, to execute extortion campaigns against commercial targets. [10]