Monday 5 October 2026
Afternoon EditionRSS
ZOTPAPER

News without the noise

ZOTPAPER
SecurityDeveloping

Qantas hack suspect cooperating with FBI as more arrests loom

Saif al-Din Khader, known online as Rey, detained in Jordan and helping police track down ShinyHunters members

By LineZotpaper
Published
Updated
Read Time2 min
Sources4 outlets
A suspected key figure in the hacking alliance behind the Qantas data breach has been detained in Jordan and is cooperating with the FBI, with sources warning more arrests are expected. Saif al-Din Khader, known online as Rey, is assisting investigators in tracking down other members of the extortion gang ShinyHunters, which also claimed to have stolen data on every FBI employee.

Saif al-Din Khader, identified by security journalist Brian Krebs in November last year as an administrator of the hacking alliance Scattered Lapsus$ Hunters, was taken into custody by Jordanian authorities last week, three sources familiar with the matter told Reuters.

Khader, who goes by the online handle Rey, is now helping the FBI and police around the world track down other members of ShinyHunters, two of the sources said. One source said Khader was walking investigators through his electronic devices and digital correspondence.

The arrest is linked to a June 2025 hack of Australian airline Qantas, in which a caller posing as IT support persuaded a worker at an offshore call centre to connect a Salesforce customer platform to a malicious data-extraction tool. ShinyHunters, part of the Scattered Lapsus$ Hunters coalition, later leaked customer data on the dark web.

Khader previously told Krebs he was trying to leave the group and had been working with law enforcement since June 2025. Despite that, ShinyHunters continued attacks into 2026, claiming breaches at Grand Theft Auto maker Rockstar Games and the education platform Canvas.

ShinyHunters claimed last month to have stolen data on every FBI employee, adding to a string of high-profile hacks. Cybersecurity researchers have linked the broader Scattered Lapsus$ Hunters alliance to multiple major breaches.

§

Analysis

Why This Matters

  • The arrest and cooperation of a key gang member could lead to a cascade of further arrests, disrupting a prolific hacking collective.
  • The alliance, responsible for the Qantas breach and other major hacks, targeted millions of users worldwide; its unraveling may reduce extortion attacks.
  • The FBI itself was recently claimed as a victim, making the investigation a priority; inside cooperation could reveal the group's methods and infrastructure.

Background

The Scattered Lapsus$ Hunters alliance is a loose coalition of mostly English-speaking hacking gangs, including ShinyHunters and the notorious Lapsus$ group. The Qantas breach in June 2025 exposed customer data through a social engineering attack on an offshore call centre worker. Since then, the group has claimed a series of high-profile data thefts, demanding extortion payments. Law enforcement has been working internationally to identify and detain members, with Khader's detention marking a significant breakthrough.

Key Perspectives

Law enforcement and intelligence agencies: The cooperation of an insider like Khader provides invaluable intelligence on the group's operations, finances, and remaining members. It may accelerate prosecutions and prevent future attacks. Cybersecurity industry: The arrest demonstrates that international police collaboration can penetrate even loose, transient hacking alliances. It may deter similar groups but does not eliminate the threat; members often migrate to new collectives. Critics: The group's continued attacks even after Khader claimed to be cooperating with law enforcement raises questions about the effectiveness of informant operations. Some may worry that publicising the cooperation could endanger other ongoing investigations.

What to Watch

  • Whether additional arrests follow in the coming weeks, as hinted by sources.
  • Whether other members of ShinyHunters retaliate or attempt to re-establish the group after Khader's cooperation becomes known.
  • New details on the FBI employee data theft, which may influence the investigation's priority and resources.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workReport an errorSubscribe