An alleged member of the ShinyHunters hacking group, which claims to have stolen data from all FBI employees, has been detained in Jordan. Reuters sources said the detainees were cooperating with the bureau to help law enforcement agencies find other members of the group.
Image source: Towfiqu/unsplash.com
Saif al-Din Khader, allegedly known as Rey, was detained by Jordanian authorities. Three sources familiar with the matter told Reuters. Two of them specified that he was detained on Tuesday, 29 September. The agency was unable to learn about the circumstances and location of Khader’s detention and was unable to contact him or his relatives.
The FBI declined to comment on specific arrests or overseas operations, but said it was continuing to investigate recent cyber incidents allegedly related to ShinyHunters. The bureau added that it has arrested several defendants together with partners and will spare no effort to bring all those involved to justice.
The ShinyHunters group has long been known for attacking major companies around the world. According to experts, the group is mainly composed of young English-speaking hackers who specialize in data theft and extortion. A Reuters analysis of some of the data transmitted by the organization revealed personal information about FBI employees, classified information about their job responsibilities, and medical and psychiatric data.
Harder’s cooperation with the investigation may help limit the damage, or at least determine its extent. According to a Reuters source, the detainee is helping investigators study his electronic devices and digital communications to determine the whereabouts of other members of the group.
ShinyHunters’ operations showed signs of disruption after it reported being hacked by the FBI. Reuters has been unable to contact representatives of the organization since Tuesday through the online account it previously used to communicate with reporters. On Wednesday, the bureau’s Dark Web site, which posted threats against the bureau, went down.
ShinyHunters representatives previously explained that the site’s unavailability was due to a glitch caused by a competitor’s sabotage and an unrelated incident. They did not respond to Reuters requests on Friday. The reason for the site’s closure has not been independently confirmed.
The group’s rhetoric has also changed. On September 22, the company said it hacked the FBI in response to an official warning that accused ShinyHunters of exaggerating the scope of its access in order to extort money from victims. The hackers gave the bureau a week to withdraw the warning. However, representatives of the organization stated in their latest letter to Reuters that they did not want the conflict to escalate further, and their information could be seen as ShinyHunters’ complete refusal to engage in further confrontation with the FBI.
FBI Director Kash Patel has previously hinted that more arrests may be made after another alleged ShinyHunters member, Pepijn van der Stap, was detained in the Netherlands. “FBI employees are currently searching for new leads. More arrests likely“Patel wrote on social media platform X on Wednesday.
Khader’s identity and his alleged ties to ShinyHunters have long been known to information security experts. Last year, independent journalist Brian Krebs identified him as a key member of the decentralized Lapsus$ Hunters, a hacker group that includes ShinyHunters. According to Krebs, Harder claimed in Signal’s communications that he had stopped engaging in data theft and extortion activities and was cooperating with law enforcement.
Meanwhile, ShinyHunters itself continues to launch attacks in 2026. The group claimed responsibility for hacking into the systems of Rockstar Games, the developer of the Grand Theft Auto series, and for the May incident on education platform Canvas, which caused widespread disruptions in U.S. schools.
If you find an error, select it with your mouse and press CTRL+ENTER.
