Jordanian authorities have detained Saif al-Din Khader, also known as Rey, a suspected key member of the hacking group ShinyHunters behind several major cyber attacks including one on Qantas. Khader is cooperating with FBI and international law enforcement agencies in tracking down other members of the gang. The FBI director has indicated that further arrests are likely, emphasizing their commitment to pursuing all responsible individuals connected to these crimes.
Written locally by qwen2.5:14b on 2026-10-05,
using this article's own text rather than the other coverage of the
same event (that is the story summary below).
A suspected key player in the hacking alliance behind the Qantas data breach has been detained in Jordan and is cooperating with the FBI.
asserted
player → suspect → FBI
Saif al-Din Khader, known online as Rey, was taken into custody by Jordanian authorities last week, three people familiar with the matter told Reuters.
asserted
people → know → Reuters
Khader is helping the FBI and police around the world track down other members of ShinyHunters, two of the sources told the news agency.
asserted
two → help → agency
ShinyHunters is the extortion gang that claimed last month to have stolen data on every FBI employee.
asserted
that → claim → employee
One source said Khader was walking investigators through his electronic devices and digital correspondence.
asserted
Khader → say → devices
In November last year, US security journalist Brian Krebs identified Khader as one of the administrators of Scattered Lapsus$ Hunters.
asserted
Krebs → identify → Hunters
It is a loose alliance of mostly English-speaking hacking gangs, including ShinyHunters.
asserted
It → speak → ShinyHunters
Khader told Krebs at the time he had been trying to leave the group and had been working with law enforcement since June 2025.
asserted
he → tell → June
ShinyHunters continued its attacks into this year, claiming break-ins at Grand Theft Auto maker Rockstar Games and education platform Canvas.
asserted
ShinyHunters → continue → Games
Cybersecurity researchers linked Scattered Lapsus$ Hunters to the leak of 5.7 million Qantas customers’ personal details on the dark web last October.
asserted
researchers → link → web
Neither Reuters nor any law enforcement agency has alleged Khader was personally involved in the Qantas attack.
asserted
Khader → allege → attack
The AFP and Qantas were contacted for comment.
asserted
AFP → contact → comment
The FBI declined to comment to Reuters on any arrest abroad, but said it had already worked with partners to arrest multiple subjects and would “spare no resource in bringing each of the responsible individuals to justice”.
asserted
it → decline → justice
FBI director Kash Patel went further, signalling the investigation was widening.
asserted
investigation → go → ?
“FBI teams are working new leads RIGHT NOW,” he posted on X on Wednesday.
asserted
he → work → Wednesday
Patel’s post followed confirmation by Dutch police that a 24-year-old Amsterdam man had been arrested in September in an investigation into ShinyHunters.
asserted
man → follow → ShinyHunters
He has been identified by Krebs and others as Pepijn van der Stap, a hacker convicted in the Netherlands in 2023 over a string of data thefts and extortions.
asserted
He → identify → thefts
ShinyHunters has said van der Stap had no association with the group.
asserted
Stap → say → group
The gang claimed on September 22 that it had hacked the FBI in retaliation for an advisory accusing it of exaggerating its access to victims’ systems.
asserted
it → claim → systems
It gave the bureau a week to withdraw the advisory.
asserted
It → give → advisory
Since then, its dark website has disappeared.
asserted
website → disappear → ?
In its most recent email to Reuters, the group said it wanted “no further escalation” with the FBI.
asserted
it → say → FBI
Police have struggled to prosecute members of related groups such as Lapsus$ and Scattered Spider, Reuters has reported.
asserted
Reuters → struggle → Lapsus$
Many of the hackers are young, the groups are chaotic and informal, and victims often decline to help investigators.
asserted
victims → decline → investigators
Qantas was hacked in June 2025, when a caller posing as IT support persuaded a worker at an offshore call centre to connect a Salesforce customer platform to a malicious data-extraction tool.
asserted
caller → hack → tool
When Salesforce refused a ransom demand, the hackers published the data.
asserted
hackers → refuse → data
Most records held names, email addresses and frequent flyer details.
asserted
records → hold → names
About 1.7 million also included home or business addresses, dates of birth, phone numbers and meal preferences.
asserted
million → include → birth
Qantas said passport and credit card details were not on the system.
asserted
details → say → system
In July, Privacy Commissioner Carly Kind declined to open a formal investigation into the airline.
asserted
Kind → decline → airline
She said the evidence did not support the likelihood that Qantas had breached privacy law.
asserted
Qantas → say → law
Serious or repeated breaches of the Privacy Act can attract penalties of more than $50 million, and the watchdog has left the door open.
asserted
watchdog → repeat → door
“It is still open to the commissioner to commence an investigation of Qantas with respect to these or other practices,” Kind said.
asserted
Kind → commence → practices
Law firm Maurice Blackburn is also pursuing a proposed class action on behalf of customers whose personal information was stolen and published online.
asserted
information → pursue → customers
Maurice Blackburn was contacted for comment.
asserted
Blackburn → contact → comment
The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion.
asserted
newsletter → deliver → stories
The Aporia
