In September 2024, I was already writing about Hikki-Chan. By January 2025, I was addressing him directly: Hi Rey.
I live this ecosystem. I follow the people, the aliases, the claims, and the history behind them. With Hikki-Chan, that context helped me spot warning signs early: recycled material, questionable credit for old incidents, and a reputation that seemed to exceed the evidence.
On October 3, 2026, Reuters reported that the alleged ShinyHunters member known as Rey had been detained by Jordanian authorities. Sources told Reuters he was cooperating with the FBI to identify other hackers. The FBI declined to confirm a specific arrest. Reuters
My reporting on this actor began more than two years before the detention report. The assessment, the dates, and the reasons are public.
In my September 2024 article, I challenged specific claims: material presented as a fresh breach that appeared to be scraped or recycled, credit taken for previously reported incidents, and data described as something it was not. These were reasons to examine his claims closely, regardless of how confidently he presented them.
He also wrote about me on his blog and claimed he had tried to contact me to correct my reporting.
I had received no such contact. I said so publicly in my January 2025 follow-up.
That exchange mattered because credibility was the issue all along.
My work is built on that context. I track an actor’s claims against their history: where the data first appeared, who originally claimed the incident, and what the evidence actually supports. Following the people and communities over time helps me recognize when a new story is being built around old material.
That understanding takes time. By the time an actor reaches the wider headlines, their earlier posts, arguments, and mistakes can already tell a very different story. In Rey’s case, I had been documenting that gap since 2024.
An inexperienced or careless actor can still hurt real people. Stolen access, borrowed tools, and capable associates can produce serious consequences. Exaggerated claims deserve scrutiny; credible evidence of harm deserves attention too.
Then came the identity exposure.
In November 2025, Brian Krebs described how account history, a carelessly shared screenshot, and infostealer records helped connect Rey’s online persona to his real identity. Krebs reported that Rey subsequently confirmed his identity in an interview. Krebs’s investigation
There is considerable irony in someone involved in the cybercrime ecosystem leaving identifying evidence in the same kind of stolen data that exposes everyone else.
Those records helped an investigation into his identity. The public reporting does not establish that they caused his detention.
I want the bad guys to lose. I want the people who steal, extort, and intimidate to discover that a reputation on a forum offers very little protection from accountability.
But making that happen takes work: researchers preserving evidence, journalists checking claims, investigators building cases, and people who understand this ecosystem well enough to recognize when the story does not fit.
The loudest actor in the room can hold everyone’s attention for a while.
Hi Rey. The posts are still there.