TL;DR: Saif al-Din Khader, also known as Rey, was detained in Jordan last week and is helping the FBI track ShinyHunters, three people familiar with the matter told Reuters. Brian Krebs identified him in November 2025 as an admin of Scattered Lapsus$ Hunters; Khader told Krebs he was trying to leave the group and had worked with law enforcement since June 2025. Researchers tied that alliance to 5.7 million Qantas records on the dark web in October 2025, but neither Reuters nor investigators alleged Khader personally ran the Qantas attack. FBI declined comment; U.S. cyber envoy Nate Patel said more arrests may follow after a Dutch arrest in September.
Status note: Checked 5 October 2026 against the Sydney Morning Herald of 5 October 2026 citing Reuters, and prior KrebsOnSecurity reporting from November 2025. Charges, extradition, and any Qantas-specific allegations can still change if prosecutors speak on the record.
How the Qantas breach unfolded
In June 2025 a caller posed as Qantas information technology staff and talked an offshore call centre employee into handing over access to a Salesforce customer tool, according to reporting on the incident. Salesforce refused a ransom demand. The stolen data later appeared online.
The exposed records included names, email addresses, and frequent flyer details for millions of customers. About 1.7 million people also had home addresses, dates of birth, phone numbers, and meal preferences on that system. Qantas said passport numbers and payment cards were not stored on the compromised Salesforce environment, a limit worth stating because social posts often assume every identity field leaked at once.
By October 2025 researchers linked a cybercrime branding itself around Scattered Lapsus$ and ShinyHunters to a dark web dump described as 5.7 million Qantas records. That linkage is an intelligence and research thread, not the same thing as a court filing naming one admin as the Qantas intruder.
Who Rey is in the gang map
Brian Krebs reported in November 2025 that Saif al-Din Khader, online as Rey, administered Scattered Lapsus$ Hunters, a faction that merged Lapsus$-style bragging with Scattered Spider tactics. Khader told Krebs he wanted out and said he had been cooperating with law enforcement since June 2025. Krebs published that interview before the Jordan detention now reported in October 2026.
Scattered Lapsus$ sits in a crowded ecosystem of English-speaking extortion groups that rotate names, affiliates, and leak sites. ShinyHunters is another label investigators watch when large corporate databases surface for sale or free download. Detaining an alleged admin can help map wallets, chat logs, and middlemen even when no single person is charged with every headline breach.
What Jordan and the FBI have said publicly
Reuters reported the Jordan detention through three people familiar with the matter, according to the Sydney Morning Herald's David Swan. The FBI declined comment on a foreign arrest, a standard posture while another country holds a witness or suspect. U.S. cyber security and digital policy envoy Nate Patel posted on X that more arrests are on the table, pointing to momentum after Dutch authorities arrested Pepijn van der Stap in September 2026. ShinyHunters publicly denied that Dutch suspect was theirs, a reminder that gang PR and investigator timelines do not always match.
None of that public record, as summarized by Reuters and SMH, attaches a Qantas indictment to Khader. Readers should hold two ideas at once: researchers connect the broader alliance to the Qantas dump, and the latest arrest story is about cooperation and gang structure, not a finished Australian airline case against this detainee.
Australia's regulatory and civil tracks
Australia's privacy regulator, the Office of the Australian Information Commissioner, left its door open to action after the breach. Law firm Maurice Blackburn continues a representative complaint on behalf of affected customers, a civil channel separate from any U.S. or Jordanian criminal process. Those paths can run for months while investigators overseas chase operators.
Where things stand
Khader's detention in Jordan and reported FBI cooperation are real developments in the ShinyHunters and Scattered Lapsus$ hunt. They are not a published charge that he executed the Qantas social-engineering hack, and they are not a verdict. Posts that merge every Scattered headline into one mugshot oversimplify a multi-jurisdiction probe.
Watch for formal charges, extradition paperwork, and whether Australian authorities add names to the Qantas file on the record. Until then, treat the Qantas mechanism and the Jordan detention as linked research narratives that law enforcement has not yet fused into a single public accusation against Rey.
Sources: Sydney Morning Herald (David Swan, citing Reuters), 5 October 2026.