ThreatPaper
Assessed, Not Confirmed

ShinyHunters figure 'Rey' was detained in Jordan and is aiding the FBI

Assessment

Reuters reported on October 3, 2026, citing three people familiar with the matter, that a ShinyHunters-linked actor using the handle 'Rey' was detained in Jordan (two sources said on a Tuesday, reported elsewhere as September 29) and is cooperating with the FBI, 'walking investigators through his electronic devices and digital correspondence.' The entire account rests on anonymous sourcing: the FBI declined to comment on any specific arrest or activity abroad, and Reuters could not determine the circumstances of the detention or his whereabouts. The assessment is reportable, but treating it as a confirmed arrest is the error.

Where this claim appeared

Reuters (via The Star) · 2026-10-03

https://www.thestar.com.my/news/world/2026/10/03/exclusive-shinyhunters-hacker-in-fbi-data-theft-detained-in-jordan-cooperating-with-bureau-sources-say

What “Assessed, Not Confirmed” means

A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.

4 of 5 · rating scale

Assessed in

Jeppesen ForeFlight extortion: ShinyHunters hits Boeing-divested aviation unit as FBI arrests mount

Think this assessment is wrong? Report an error.