By Jana Winter, Raphael Satter and AJ Vicens
WASHINGTON, Oct 3 (Reuters) – A suspected member of the ShinyHunters hacking group, which says it stole data on every FBI employee, was detained in Jordan this week and is cooperating with the FBI, three people familiar with the matter told Reuters.
Saif al-Din Khader was detained by Jordanian authorities, the three sources said. Two of them said he was brought into custody on Tuesday. Reuters could not immediately determine the circumstances of Khader’s detention or where he is being held. Two sources said that he is helping the FBI and global law enforcement locate the other hackers in the group.
The FBI declined to comment on any specific arrest or activity abroad but said that the bureau “continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects — and we will spare no resource in bringing each of the responsible individuals to justice.”
Reuters’ attempts to reach Khader and members of his family over the past week and a half have been unsuccessful.
The detention of Khader — whose alleged hacker nickname is Rey — is the latest twist in the case of ShinyHunters. The prolific cyber extortion group, which has a long history of targeting major corporations around the world, is believed by experts to consist mainly of young, English-speaking hackers focused on data theft and extortion.
Their theft of what they claim are mountains of data on every single FBI employee has drawn comparisons to the allegedly Chinese-linked intrusion at the US Office of Personnel Management in 2015, which compromised sensitive details on millions of Americans who had been vetted for security clearances.
SENSITIVE INFORMATION
A Reuters analysis of a sample of the data shared by ShinyHunters revealed that the data contained extensive personally identifiable information of FBI employees, sensitive job role information, and psychiatric and medical information.
Khader’s cooperation with investigators could be critical to helping contain — or at least understand — the damage. One source said he was walking investigators through his electronic devices and digital correspondence to help the FBI locate his cohorts.
“His cooperation is critical to ongoing efforts to arrest these hackers,” the source told Reuters.
There have been hints for days that ShinyHunters was experiencing disruption following the announcement of its break-in at the FBI. Beginning on Tuesday, Reuters was unable to reach ShinyHunters through the online account it previously used to communicate with journalists. Then, on Wednesday, the group’s dark web site, where it had previously posted threats to the FBI, disappeared.
FBI Director Kash Patel had been hinting at more arrests following the announcement that another alleged ShinyHunters member, Pepijn van der Stap, had been detained in the Netherlands.
“FBI teams are working new leads RIGHT NOW,” Patel said on Wednesday in a message posted to X. “More arrests are on the table.”
The operators of a ShinyHunters-linked email address did not respond to a request for comment on Friday. The operators of that email account previously told Reuters that the group’s site had gone offline due to sabotage from rivals and “disruption due to an unrelated incident.”
The group had previously struck a defiant note, saying on September 22 that it had hacked the FBI in retaliation over an advisory that accused ShinyHunters of making “exaggerated claims of access” to extort victims for money. It gave the FBI a week to withdraw the advisory.
But in the most recent email to Reuters, the operators struck a conciliatory tone, saying that “we want no further escalation” with the FBI. The operators said Reuters could interpret their message as meaning, “ShinyHunters backing down completely.”
KHADER’S IDENTITY LONG KNOWN
Khader’s identity, and his alleged connection to ShinyHunters, have long been known to security researchers.
Last year, the independent journalist Brian Krebs reported that Khader was a key member of Scattered Lapsus$ Hunters, an umbrella group of hackers that included ShinyHunters. Krebs, who said he spoke to Khader over Signal, quoted the teenager as saying he had quit the world of data breaches and extortion and was cooperating with law enforcement.
But ShinyHunters continued its hacking spree into 2026, claiming credit for break-ins at video game developer Rockstar Games, the maker of “Grand Theft Auto,” and a May intrusion involving education tool Canvas that caused widespread disruption across US schools.
Law enforcement agencies around the world, including in the United States, have struggled to arrest and prosecute members of related groups such as Lapsus$ or Scattered Spider, Reuters has previously reported.
Sources told Reuters that the difficulty stems from the hackers’ young ages, which can make prosecutions complex, or because the groups they belong to are so chaotic and informal, or because victims of their extortion attempts often decline to help investigators.
(Reporting by Raphael Satter; Editing by Sanjeev Miglani)
