‘More arrests are on the table’: Qantas hack gang member snatched

A thought essential gamer in the hacking alliance behind the Qantas information breach has actually been apprehended in Jordan and is complying with the FBI.

Saif al-Din Khader, understood online as Rey, was apprehended by Jordanian authorities recently, 3 individuals acquainted with the matter informed Reuters.

Khader is assisting the FBI and authorities worldwide locate other members of ShinyHunters, 2 of the sources informed the news company. ShinyHunters is the extortion gang that declared last month to have actually taken information on every FBI staff member. One source stated Khader was strolling detectives through his electronic gadgets and digital correspondence.

In November in 2015, United States security reporter Brian Krebs recognized Khader as one of the administrators of Scattered Lapsus$ Hunters. It is a loose alliance of primarily English-speaking hacking gangs, consisting of ShinyHunters.

Khader informed Krebs at the time he had actually been attempting to leave the group and had actually been dealing with police considering that June 2025. ShinyHunters continued its attacks into this year, declaring burglaries at Grand Theft Auto maker Rockstar Games and education platform Canvas.

Cybersecurity scientists connected Scattered Lapsus$ Hunters to the leakage of 5.7 million Qantas consumers’ individual information on the dark web last October. Neither Reuters nor any police has actually declared Khader was personally associated with the Qantas attack.

The AFP and Qantas were called for remark.

The FBI decreased to comment to Reuters on any arrest abroad, however stated it had actually currently dealt with partners to jail several topics and would “extra no resource in bringing each of the accountable people to justice”. FBI director Kash Patel went even more, signalling the examination was expanding. “FBI groups are working brand-new leads RIGHT NOW,” he published on X on Wednesday. “More arrests are on the table.”

Patel’s post followed verification by Dutch cops that a 24-year-old Amsterdam guy had actually been detained in September in an examination into ShinyHunters. He has actually been determined by Krebs and others as Pepijn van der Stap, a hacker founded guilty in the Netherlands in 2023 over a string of information thefts and extortions. ShinyHunters has actually stated van der Stap had no association with the group.

The gang declared on September 22 that it had actually hacked the FBI in retaliation for an advisory implicating it of overemphasizing its access to victims’ systems. It provided the bureau a week to withdraw the advisory. Ever since, its dark site has actually vanished. In its latest e-mail to Reuters, the group stated it desired “no more escalation” with the FBI.

Cops have actually struggled to prosecute members of associated groups such as Lapsus$ and Scattered Spider, Reuters has actually reported. A number of the hackers are young, the groups are disorderly and casual, and victims frequently decrease to assist private investigators.

Qantas was hacked in June 2025, when a caller impersonating IT support convinced an employee at an overseas call centre to link a Salesforce consumer platform to a destructive data-extraction tool. When Salesforce declined a ransom need, the hackers released the information.

A lot of records held names, e-mail addresses and regular leaflet information. About 1.7 million likewise consisted of home or organization addresses, dates of birth, telephone number and meal choices. Qantas stated passport and charge card information were not on the system.

In July, Privacy Commissioner Carly Kind decreased to open an official examination into the airline company. She stated the proof did not support the possibility that Qantas had actually breached personal privacy law.

Major or duplicated breaches of the Privacy Act can draw in charges of more than $50 million, and the guard dog has actually left the door open. “It is still open up to the commissioner to begin an examination of Qantas with regard to these or other practices,” Kind stated.

Law practice Maurice Blackburn has actually lodged a representative problem with the Office of the Australian Information Commissioner (OAIC) on behalf of impacted consumers. The procedure works like a class action, however goes through the personal privacy regulator instead of the courts.

“The choice to not continue even more with the regulative examination has actually not indicated that the representative problem has actually likewise been dismissed,” Maurice Blackburn primary Elizabeth O’Shea stated.

“We think it must continue and have actually stated so to the OAIC.”

Business Briefing newsletter provides significant stories, unique protection and professional viewpoint. Register to get it every weekday early morning