Suspected ShinyHunters figure detained in Jordan, reportedly aiding FBI

Reports published on October 3 said Jordanian authorities took Saif al-Din Khader into custody on September 29. Sources identify him as a prominent figure in ShinyHunters and say he is assisting the FBI and other law-enforcement agencies in finding other hackers.¹³⁵

Cooperation with investigators

People familiar with the case said Khader was cooperating with the FBI to identify other members of ShinyHunters. One source told Reuters that he was taking investigators through his devices and digital communications, while another described his assistance as important to continuing efforts to arrest the hackers. Those details have not been independently confirmed beyond that report.¹²³

The circumstances in which Khader was detained and his current whereabouts could not be established. Reuters also reported that attempts to contact him and his family during the previous week and a half had failed. The FBI declined to address any particular arrest or overseas operation.¹²³⁴

The bureau said it was continuing an intensive investigation into the recent cyber incident allegedly involving ShinyHunters and had already worked with partners to arrest several subjects. FBI Director Kash Patel separately said teams were pursuing new leads and that further arrests were possible, according to one report.¹²³⁴

Claims about FBI data

ShinyHunters has claimed that it obtained information covering every FBI employee. A Reuters examination of a sample shared by the group found what the news agency described as extensive personally identifiable information, employment details and psychiatric and medical material concerning bureau personnel. That finding was reported by one source and has not been independently confirmed.¹²³

One report from Jordan said the group announced in September 2026 that it had taken about three terabytes of FBI data, including personal information relating to Patel. The FBI has described the matter as an alleged cyber incident involving ShinyHunters rather than publicly confirming the scope of the group’s claims.¹³⁴

The alleged theft has been compared with the 2015 intrusion into the US Office of Personnel Management, which compromised sensitive information about millions of Americans who had undergone security-clearance vetting. That earlier incident was allegedly linked to China.¹²³

The group and its stated motive

Experts describe ShinyHunters as a largely young, English-speaking group focused on stealing data and using it for extortion. A Jordanian report characterised it as an organised cybercrime operation active since 2019 or 2020 and specialising in the theft of large corporate and government databases.¹²³⁴

On September 22, ShinyHunters said it had compromised the FBI in retaliation for an agency advisory and gave the bureau one week to withdraw it. Another report said the advisory, issued in May 2026, described the group’s methods and discouraged ransom payments. The operators later said they wanted no further escalation with the FBI.²⁵

The group’s dark-web site subsequently disappeared, and Reuters could no longer reach ShinyHunters through an online account used previously. Its operators attributed the outage to sabotage by rivals and disruption connected with an unrelated incident, according to one report.²