How ShinyHunters Hacker Rey Was Unmasked: The Username Trail

In September 2026, the extortion crew ShinyHunters defaced the FBI's job site and threatened to leak data on every agent and applicant. Between September 15 and October 8, three suspects were arrested or detained on three continents. One of them is Rey, a teenager and one of the administrators of Scattered LAPSUS$ Hunters, the alliance ShinyHunters belongs to. Rey was reportedly detained in Jordan and is said to be cooperating with the FBI.

Nobody hacked Rey back to find him. Researchers followed his own trail: an old forum name, a Telegram handle he left as a contact, and one screenshot he shouldn't have posted. Here's that trail step by step, which parts were public and which weren't, and what it teaches anyone who investigates people online, or worries about being found.

The short version

• ShinyHunters is an extortion brand behind a string of data thefts in 2025 and 2026, including the breach of the FBI's job site in September 2026.
• Three suspects have been arrested or detained: a 24-year-old man in Amsterdam, Rey in Jordan, and a Canadian ransomware negotiator in Pennsylvania.
• Rey was identified back in November 2025 by KrebsOnSecurity, building on work by threat-intelligence firms. The trail ran from his old name "Hikki-Chan" to a Telegram handle, a leaked password, an older alias and finally a family computer in Amman.
• Public posts started the trail, and leaked data finished it. The forum posts, the screenshot and the website archives were public. The hops that put a real name on him came from breach databases and infostealer logs.

What's happened so far

These are allegations, not convictions. Rey hasn't been publicly charged. Dubrovsky is charged with conspiracy to extort, but the public court filings don't mention ShinyHunters, and the FBI hasn't confirmed his name.

ShinyHunters isn't one fixed gang. KrebsOnSecurity calls it a "prolific and amorphous" brand whose members come from "the Com", a loose online network of mostly young cybercriminals. In 2025, it phoned employees of Salesforce customers while posing as IT support, stole their company data, and then teamed up with Scattered Spider and Lapsus$ as Scattered LAPSUS$ Hunters.

Who is Rey?

Rey was one of the three administrators of the Scattered LAPSUS$ Hunters Telegram channel. Before that, he was an administrator of the Hellcat ransomware group's leak site, and he used his X account to taunt the FBI.

In November 2025, KrebsOnSecurity identified him as a 15-year-old living in Amman, Jordan. Brian Krebs emailed Rey's father. Less than two hours later, Rey messaged Krebs on Signal, confirmed who he was, and said he had been talking to law enforcement "since at least June". Krebs couldn't verify that claim.

Reuters and KrebsOnSecurity have published Rey's real name. We aren't repeating it, because he was a minor when he was identified and he hasn't been publicly charged.

How Rey was unmasked, step by step

Krebs built the chain with data from three threat-intelligence companies. Intel 471 and Flashpoint archive criminal forums and chats. SpyCloud collects breach data and infostealer logs, which are the saved passwords and cookies that malware steals from infected computers.

1. Rey used to be "Hikki-Chan". Intel 471's forum archive showed that Rey had earlier posted on BreachForums as Hikki-Chan.
2. Hikki-Chan left a contact. His first BreachForums post, in February 2024, said he could be reached at the Telegram handle @wristmug.
3. @wristmug posted a screenshot. In May 2024, he shared a sextortion scam email in a Telegram group chat. The scam quoted his email address and an old password. He blacked out the username part of the address, but left the domain, proton.me, and the password visible. "Noooooo," he wrote. "I must be done guys."
4. The password pointed to one email. It was a rare 15-character password. In SpyCloud's data, it was linked to just one email address: a Proton Mail address built around the handle o5tdev. Infostealer malware had captured it from his computer in early 2024.
5. The email matched an older forum account. Intel 471 linked that address to a BreachForums member called o5tdev.
6. The old handle had a public past. A Google search for o5tdev turned up website-defacement archives crediting the handle to a pro-Palestinian hacktivist crew, Cyb3r Drag0nz Team.
7. He'd talked about himself. In chat logs archived by Flashpoint, Rey said his father was an airline pilot, claimed to be 15, and mentioned family ties to Ireland.
8. A family computer matched the story. SpyCloud's infostealer logs showed a shared Windows PC in Amman. Its saved logins included a family member signing in to an airline's staff portals and an Irish family surname, and they gave Rey's full name.

Another firm got there first. In March 2025, eight months before Krebs, the threat-intel company KELA traced Hikki-Chan to a young person in Amman using its own infostealer data. He had been infected twice in early 2024, and the logs also exposed his older handles, o5tdev and ggyaf. As KELA put it: "Ironically, Rey and Pryx, who heavily relied on infostealer logs in their operations, fell victim to it themselves."

Public data started it, leaked data finished it

Three of the eight hops used fully public material: a forum post, a Telegram screenshot and a website archive. The rest relied on data most people can't access: breach records, infostealer logs and commercial archives of criminal chats.

The two halves needed each other. The public posts gave investigators things to search for: a handle, a password, an email domain. The leaked data turned those search terms into a person. Without the screenshot, there would have been nothing to look up. Without the breach data, the screenshot would have been a dead end.

Other hackers caught by their own handles

Rey's case fits a long pattern:

• pompompurin, BreachForums founder (arrested 2023). Conor Fitzpatrick had signed up for Zoom as "pompompurin" with the same email as his forum account, and an old Gmail address in his real name sat in a 2017 breach. He even told a forum admin he'd looked up "one of my old emails" on Have I Been Pwned (FBI affidavit). He was resentenced to three years in 2025.
• Kiberphant0m, AT&T and Verizon extortion (2024). His first forum post listed a Telegram contact, and chat archives tied that account to a name that had posted "I am a u.s. soldier" in a gaming Discord (KrebsOnSecurity). Army soldier Cameron Wagenius was sentenced to 70 months in September 2026.
• Pryx, Rey's Hellcat partner (2025). KELA tied him to a code repository whose owner had changed their username from "patopw" but kept the same email.
• This month's Pennsylvania arrest. KrebsOnSecurity matched a court record for an "Edward Dobrovsky" (sic) to Dubrovsky partly through his own LinkedIn post about attending a cyber-insurance conference in Philadelphia that week.

The same mistakes come up again and again:

• Old accounts outlive the persona. A new name doesn't erase the old one.
• Personas point to each other. Contact handles in posts and bios lead from one identity to the next.
• The same handle shows up on everyday services, like Zoom, Discord, GitHub and email.
• People talk about themselves. An age, a parent's job or a conference trip can narrow millions of people down to one.

How to follow a username trail

These are the moves that worked in Rey's case, written as a method:

1. Search every alias, not just the current one. Old handles carry the most history and the least caution.
2. Treat contact fields as new searches. A Telegram handle in a forum post, an email in a GitHub commit and a link in a bio are all pivots.
3. Read email addresses as usernames. The part before the @ is often a handle with a prefix or numbers added. "o5tdev" sat inside the email that unlocked Rey's past.
4. Check the archives. Deleted profiles survive in the Wayback Machine, and defacement archives credit hackers by handle.
5. Corroborate every link. Treat a match as a lead until two independent details agree, such as the same avatar, timeline, location or writing style. Online sleuths have accused the wrong person before. Even with eight matching hops, Krebs had Rey's own confirmation before publishing.

Try the public half yourself

The public half of Rey's trail came down to three questions: where does this handle exist, what does the profile say, and which other handles does it point to? Those are the questions Fingerprint.to answers.

• A username search checks a handle across 700+ sites in about 20 seconds. They include Telegram, GitHub, X, Discord, Reddit, Keybase, Pastebin and Steam, plus security platforms like HackerOne, Hack The Box and TryHackMe.
• An email search checks nearly 200 services for accounts registered to an address.
• Deep Search runs the pivots for you. When a profile lists another username or email in its bio, links or contact details, it searches that too, up to three layers deep. It's on the Max plan.

Fingerprint searches public profiles only. It has no breach databases, leaked passwords, infostealer logs or chat archives, which are the sources that closed Rey's case. Those come from threat-intelligence companies like SpyCloud, KELA, Intel 471 and Flashpoint, which sell mostly to businesses and law enforcement.

You can run a search free, with no account, on the demo.

Check your own username trail

You don't have to be a hacker for this to matter. The same mechanics connect anyone's accounts: an old gaming handle inside an email address, a Telegram username in a bio, a password reused for ten years.

• Search your old usernames, not just your current one. The account you made at 14 is often the one that names you.
• Check your email addresses on Have I Been Pwned and change any password that turns up there.
• Use a password manager so no two sites share a password.
• Check every screenshot before you post it. Rey blacked out his username and missed his password.
• Remove links between accounts you want kept separate. Payment apps are a common weak point; we covered why in how Venmo, Cash App and PayPal link usernames to real names.

If Fingerprint shows something about you that you want gone, use the opt-out page.

FAQ

Who is Rey from ShinyHunters?

Rey is the online alias of a teenager from Amman, Jordan. He was one of the administrators of Scattered LAPSUS$ Hunters, the alliance that includes ShinyHunters, and was previously an administrator of the Hellcat ransomware group's leak site. He earlier used the names Hikki-Chan and o5tdev. KrebsOnSecurity identified him in November 2025, when he was 15.

Has Rey from ShinyHunters been arrested?

Reuters reported on October 3, 2026, citing three unnamed sources, that Rey was detained in Jordan in late September and is cooperating with the FBI. The FBI declined to comment, and no charges against him have been made public.

How was Rey from ShinyHunters identified?

Researchers followed his usernames. His old BreachForums name, Hikki-Chan, listed a Telegram handle. That handle posted a screenshot showing an old password, which matched one email address in breach data. The email led to an older alias, o5tdev, and infostealer logs from a family computer in Amman gave his full name. Rey then confirmed his identity to KrebsOnSecurity.

Who else has been arrested in the ShinyHunters investigation?

Dutch police arrested a 24-year-old Amsterdam man on September 15, 2026, whom KrebsOnSecurity and NOS identified as convicted hacker Pepijn van der Stap. On October 8, the FBI arrested a man in Pennsylvania that it called a suspected ShinyHunters co-conspirator. KrebsOnSecurity and Reuters reported that he is Canadian ransomware negotiator Edward Dubrovsky. The FBI hasn't confirmed his name, and neither man has been convicted.

Can a username search identify an anonymous hacker?

On its own, rarely. A username search shows where a handle exists and what those profiles reveal, which is often how a trail starts. In Rey's case, public posts supplied the leads, but getting from alias to real name took breach data, infostealer logs and confirmation from Rey himself.