Qantas hack suspect arrested in Jordan cooperating with FBI

A key figure in the hacking collective behind the Qantas data breach has been arrested in Jordan and is cooperating with the FBI. Saif al-Din Khader, known online as Rey, was detained last week and is assisting authorities in tracking down other members of ShinyHunters, according to three sources familiar with the matter.

Khader is reportedly walking investigators through his electronic devices and digital correspondence, helping the FBI and global police forces identify additional suspects. The hacking group ShinyHunters claimed last month to have stolen data on every FBI employee, though the veracity of this claim remains unconfirmed. Khader was previously identified by US security journalist Brian Krebs as an administrator of Scattered Lapsus$ Hunters, a loose alliance of hacking gangs.

The Qantas breach occurred in June 2025 when a caller impersonating IT support tricked an offshore call center worker into connecting a Salesforce customer platform to a malicious data-extraction tool. The hackers later published the stolen data after Salesforce refused to pay a ransom demand. Cybersecurity researchers linked Scattered Lapsus$ Hunters to the leak of 5.7 million Qantas customers’ personal details on the dark web in October 2025.

FBI director Kash Patel signaled that the investigation is widening, posting on X that “more arrests are on the table.” Dutch police also arrested a 24-year-old man in Amsterdam in September, identified as Pepijn van der Stap, a hacker previously convicted in the Netherlands for data theft and extortion. ShinyHunters has denied any association with van der Stap.