Jordan has confirmed that it is holding a suspected member of ShinyHunters, the extortion group that says it stole personnel data on FBI employees last month. An official quoted by Jordanian state media on Saturday said the arrest took place last week and that “investigations are ongoing with the suspect about the activities of the group and the groups it is connected with,” The National reported. Jordan’s Al-Mamlaka television said the arrest followed the alleged FBI breach, according to Al Bawaba.
Jordanian authorities have not named the suspect, said what he is accused of or described what evidence led to the arrest.
What Reuters’ sources say
Almost everything else known about the arrest comes from one outlet. Reuters, citing three people familiar with the matter, reported that the man held is the hacker known online as “Rey” and that he was taken into custody on Tuesday, Sept. 29. Two of those sources said he is helping the FBI and other agencies identify and locate other members of the group, and one said he has walked investigators through his devices and digital messages. “His cooperation is critical to ongoing efforts to arrest these hackers,” a source told Reuters. Other outlets, including BleepingComputer, The Hacker News and The National, have relied on Reuters for these details. Neither Jordan nor the FBI has confirmed them.
Rey has been publicly linked to ShinyHunters’ wider network before. In November 2025, the security journalist Brian Krebs identified him as one of three administrators of Scattered LAPSUS$ Hunters, an alliance that includes ShinyHunters, and reported that Rey had told him he had been cooperating with law enforcement since at least June 2025. Krebs said he could not verify that claim. In the same report, Krebs noted that Rey had claimed in 2024 to be 15 years old. Because he may still be a minor, we are not publishing the name other outlets have reported.
The FBI’s response
The FBI declined to comment on any arrest or activity in Jordan, The National reported. In a statement, the bureau said it “continues to aggressively investigate” the incident allegedly involving ShinyHunters. FBI Director Kash Patel wrote on X after an earlier arrest in the Netherlands that more arrests were “on the table,” The Hacker News and The National reported.
There are signs the group has been disrupted. On the day Rey was reportedly detained, a messaging account that had been speaking to the media for ShinyHunters shut down, and the group’s data leak site later went offline, BleepingComputer reported. Its main representative stopped answering questions from BleepingComputer and Reuters. The National reported that a request for comment sent to a ShinyHunters-linked address on Friday got no reply.
What our first report left out, and what has moved
When we reported on the breach on Sept. 30, we described its scale as resting largely on ShinyHunters’ own word. Two points need updating.
The first is the content of the data. Reuters examined documents shared by ShinyHunters and found that they included sensitive psychiatric and medical files on FBI staff, according to KrebsOnSecurity and The National. Our Sept. 30 report presented medical data only as a claim by the group and by current and former employees, and did not cite Reuters’ review, which had already been published. The FBI still has not published how many people were affected.
The second is the Dutch arrest. Dutch police announced on Sept. 29 that they had arrested a 24-year-old Amsterdam man on Sept. 15 in the ShinyHunters investigation. Krebs, citing three sources, has identified him as Pepijn van der Stap, who was convicted in 2023 over earlier data thefts and extortion. Dutch authorities have not publicly named him.
What is still not known
No one has been publicly charged with the FBI breach itself. Jordan has not said whether its suspect will face charges at home or extradition, and we found no public U.S. charging document. It is also not established what role, if any, Rey played in the FBI intrusion, as opposed to the group’s other operations.
This story is developing. Our earlier report, The FBI Breach: What’s Confirmed and What’s Only Claimed, covers the breach itself and the 2015 OPM precedent.
Jordan Confirms a ShinyHunters Arrest After the FBI Breach
Sources
- The National: Jordan confirms arrest of suspected hacker after FBI data theft claim (Oct. 4, 2026). Used for: the Jordanian official’s statement, the FBI’s statement, Patel, Reuters’ sample analysis, no reply from the group.
- Al Bawaba: From FBI breach to arrest in Jordan (Oct. 3, 2026). Used for: Al-Mamlaka television’s report; Jordan not disclosing the evidence or charges.
- BleepingComputer: ShinyHunters hacker reportedly detained in Jordan, aiding FBI (Oct. 3, 2026). Used for: Reuters’ account of the Tuesday detention; the group’s accounts and leak site going dark.
- The Hacker News: ShinyHunters suspect Rey reportedly detained in Jordan (Oct. 4, 2026). Used for: Reuters’ three sources; Patel’s posts on X.
- KrebsOnSecurity: Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’ (November 2025). Used for: Rey’s role, his claimed cooperation, his claimed age in 2024.
- KrebsOnSecurity: Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation (Sept. 28, 2026). Used for: the Dutch suspect’s identity and 2023 conviction; Reuters’ review of psychiatric and medical files.
- Hackread: ShinyHunters suspect “Rey” detained in Jordan (Oct. 3, 2026). Used for: Reuters’ sourcing of the Tuesday detention.