A Timeline of the ShinyHunters Crackdown After a Key Arrest Report

Extortion crews that steal SaaS and cloud data rarely vanish overnight, but arrests can scramble their operations. Here is a short timeline of what Reuters and BleepingComputer reported about a suspected ShinyHunters member and the disruption that followed.

How we got here

Recent years: ShinyHunters has been tied to large data-theft and extortion campaigns, including activity against Salesforce-connected environments and other cloud SaaS targets, with incidents discussed publicly involving brands such as Google and Cisco.
September 2026: The group told BleepingComputer it breached FBI systems via an alleged Oracle PeopleSoft zero-day and moved into FBI-managed AWS GovCloud, claiming 2–3 TB of data. BleepingComputer has not independently verified those claims; the FBI confirmed it was investigating unauthorized activity but did not confirm data theft.
September 15, 2026: Dutch police arrested a 24-year-old Amsterdam man in a ShinyHunters-related investigation. Reporting by KrebsOnSecurity and DataBreaches identified him as Pepijn van der Stap, previously known as “Umbreon.” The FBI later urged remaining members to surrender.

This week’s reported detention

Tuesday (this week): Reuters sources say Jordanian authorities detained Saif al-Din Khader, known online as “Rey,” and that he is cooperating with the FBI, including walking investigators through devices and communications.
Same day: An alleged affiliate messaging account used with media went silent; the ShinyHunters leak site later went offline and the main media contact stopped answering BleepingComputer and Reuters.
Thursday: A new ShinyHunters leak site appeared online, suggesting others are still running the extortion arm.
Background on Rey: Prior reporting linked the alias to HellCat activity, Jira-targeted thefts, and channels associated with “Scattered Lapsus$ Hunters.” In November 2025, Brian Krebs reported identifying Rey as Khader from infostealer logs and conversations; Khader claimed at the time he had been talking to law enforcement since at least June—claims Krebs said he could not verify.

What this means for your company

Law-enforcement pressure helps, but SaaS token theft and third-party integrations remain the practical risk:

Audit connected apps. Review OAuth grants and integration accounts tied to CRM, file, and support platforms.
Shorten token life and monitor unusual API pulls. Mass exports and odd login geography deserve alerts.
Plan for extortion noise. Decide in advance who speaks if criminals contact staff or customers.

Need help reviewing SaaS integrations and reducing extortion exposure? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.

This timeline is based on BleepingComputer’s coverage of the reported ShinyHunters detention.