Overview
- Reuters and multiple outlets say a suspected ShinyHunters operator, Saif al‑Din Khader known online as “Rey,” was taken into custody on Tuesday, Sept. 29 and is cooperating with U.S. and international investigators.
- Sources report Khader is walking law enforcement through his electronic devices and messages to help link aliases, accounts and infrastructure to other alleged members.
- The FBI says it is aggressively investigating the incident and has worked with partners to arrest multiple suspects, including a Dutch arrest on Sept. 15 in the same probe.
- ShinyHunters claims it stole roughly 2–3 terabytes of recruitment and personnel data from FBI‑related systems, including records for current and former employees and sensitive medical information.
- Security firms have traced likely exploitation of an Oracle PeopleSoft vulnerability, CVE‑2026‑35273, and possible lateral moves into cloud environments, and forensic teams are still validating the breach scope while the group’s leak sites show disruption and intermittent recovery.