Jordanian security forces have taken a leading figure of the ShinyHunters hacking collective into custody. The detainee, identified as Saif al-Din Khader, is known online by the handle "Rey". He is now assisting U.S. investigators by providing access to his devices and communications to trace other operatives. This arrest is seen as a significant breakthrough in the efforts to crack down on the cybercrime group.
The FBI has declined to comment on specific arrests abroad but reiterated its commitment to aggressively pursue the recent ShinyHunters breach. The group claimed responsibility for a September 2026 intrusion into the FBIJobs.gov portal, alleging theft of 2-3 terabytes of data. The stolen data included personal, medical, and employment records of prospective FBI agents. An analysis of the leaked files confirmed the presence of extensive personally identifiable information.
The Jordanian arrest follows a September 15 capture in the Netherlands of a 24-year-old Dutch resident suspected of involvement with ShinyHunters. The individual was also linked to unrelated murder-solicitation allegations. The arrest in Jordan is seen as a critical development in the investigation, with a source describing Khader's cooperation as "critical" to ongoing efforts to arrest additional members of the group.
FBI Director Kash Patel highlighted Khader's detention, describing him as one of the alleged leaders of the globally active cyber-crime group. He noted that FBI teams are pursuing further leads. The investigation into ShinyHunters' activities is ongoing, with the group having targeted technology, healthcare, and professional services firms throughout 2026.
ShinyHunters first announced the FBI breach in late September 2026, demanding the agency either correct or remove a May 2026 advisory describing ShinyHunters as a cyber-criminal entity. After the deadline passed, ShinyHunters' website went offline, with the group later claiming a DDoS attack forced the move. The group stated it would not publish the stolen FBI data, describing the episode as a "marketing campaign".
Despite a 2025 manifesto indicating a retirement from hacking, the collective remained active, targeting notable companies such as Logitech/Streamlabs. The group's activities have been a significant concern for law enforcement agencies globally. The cooperation of Khader is expected to provide valuable insights into the group's operations and help identify other members.
The investigation into ShinyHunters' activities is ongoing, with law enforcement agencies working to identify and apprehend other members of the group. The arrest of Khader and the cooperation he is providing are seen as significant developments in the case. The FBI and other agencies are pursuing further leads to bring the individuals responsible to justice.
Key points
- Jordanian authorities arrest key ShinyHunters hacker, Saif al-Din Khader, who is cooperating with the FBI to locate other members of the cybercrime group.
- The ShinyHunters group claimed responsibility for a September 2026 intrusion into the FBIJobs.gov portal, alleging theft of 2-3 terabytes of data.
- The investigation into ShinyHunters' activities is ongoing, with law enforcement agencies working to identify and apprehend other members of the group.
