ShinyHunters Hacker Detained in Jordan, Reportedly Cooperating With FBI
A suspected key member of the ShinyHunters hacking group has been detained in Jordan and is reportedly cooperating with the FBI, potentially giving U.S. and international investigators new information about one of the most closely watched cybercrime networks.
Saif al-Din Khader, who is known online by the alleged hacker alias “Rey,” was detained by Jordanian authorities earlier this week, according to three people familiar with the matter who spoke to Reuters. Two of those sources said Khader is cooperating with the FBI and helping investigators identify other members of the group. Reuters said it could not independently determine the circumstances of his detention or where he is currently being held.
The development comes as authorities investigate a major cyber incident involving the FBI and as ShinyHunters appears to be facing increasing pressure from law enforcement.
Who Is Saif al-Din Khader?
Khader's alleged connection to the ShinyHunters ecosystem was already known to cybersecurity researchers.
His online identity, “Rey,” was previously linked by security journalist Brian Krebs to Scattered Lapsus$ Hunters, an umbrella group associated with members of ShinyHunters, Lapsus$ and Scattered Spider. Krebs reported in 2025 that he had spoken with Khader, who said he was attempting to distance himself from cybercrime and was cooperating with law enforcement. Those earlier claims could not be independently verified at the time.
The latest reports therefore represent a significant escalation: authorities have now detained a person whom researchers had previously linked to the wider hacking ecosystem.
Reuters reported that one source said Khader was walking investigators through his electronic devices and digital communications. Two sources said his cooperation could help the FBI and other law enforcement agencies locate additional members of the group. (Reuters)
Why the ShinyHunters Investigation Matters
ShinyHunters has a long record of targeting large organisations and allegedly stealing data for extortion.
The group recently claimed responsibility for a breach involving the FBI and said it had obtained data concerning every FBI employee. Reuters' analysis of a sample of the material reportedly found personally identifiable information, sensitive job-role information and medical and psychiatric information belonging to FBI employees. (Reuters)
The FBI has not publicly confirmed the full scope of the hackers' claims. The bureau declined to comment specifically on Khader's detention but said it continues to aggressively investigate the cyber incident allegedly involving ShinyHunters and has already worked with partners to arrest multiple subjects. (Reuters)
That distinction is important. Claims made by a hacking group about the scale of stolen data should not automatically be treated as independently verified facts.
ShinyHunters Appears to Be Under Growing Pressure
Khader's detention follows the recent arrest in the Netherlands of another alleged ShinyHunters member, Pepijn van der Stap.
Dutch authorities arrested the 24-year-old in September in a case linked to the hacking group. The FBI has been working with international partners as investigators attempt to identify and apprehend additional suspects. (Reuters)
FBI Director Kash Patel also indicated that more arrests could follow. Reuters reported that Patel said FBI teams were working on new leads and that additional arrests remained possible. (Reuters)
The combination of arrests in different countries highlights the international nature of modern cybercrime investigations. Hackers can operate remotely, use infrastructure across jurisdictions and target companies or government agencies thousands of kilometres away.
That makes cooperation between national law-enforcement agencies increasingly important.
The FBI Breach Adds to the Stakes
The alleged FBI intrusion is particularly sensitive because of the type of information potentially involved.
Reuters said the sample it reviewed included medical and psychiatric information as well as personal identifying details and employment-related information. Such data can create risks beyond conventional financial fraud, including identity theft, targeted social engineering and potential security concerns. (Reuters)
The incident has also drawn comparisons with the 2015 breach of the U.S. Office of Personnel Management, although the scale and circumstances of the two incidents are different.
For businesses and governments, the episode reinforces a broader cybersecurity lesson: a breach involving employee information can become strategically important even when the compromised systems are not directly responsible for critical operations.
Why the Detention Could Be Important for Investigators
The most significant aspect of Khader's reported cooperation may be the information investigators can obtain from his communications and devices.
Cybercrime groups are often decentralised. Members may communicate through encrypted messaging platforms, temporary online accounts and pseudonymous identities. Investigators can therefore face major difficulties connecting online aliases to real-world individuals.
If Khader provides usable information about other alleged members, infrastructure or communications, authorities could potentially accelerate investigations that would otherwise take much longer.
However, cooperation does not automatically mean that every allegation made by a cooperating suspect will be accurate or sufficient for prosecution. Investigators still need to corroborate evidence and establish the role of individual suspects.
ShinyHunters' Own Communications Have Changed
There are also signs that the pressure may already be affecting the group's operations.
Reuters reported that its journalists were unable to reach a ShinyHunters-linked online account beginning Tuesday, while the group's dark-web site disappeared on Wednesday. The operators previously attributed the site's disappearance to sabotage by rivals or an unrelated disruption. (Reuters)
More recently, the group reportedly adopted a less confrontational tone toward the FBI.
After previously claiming that its attack was retaliation for an FBI advisory and demanding that the bureau withdraw it, ShinyHunters later told Reuters that it wanted “no further escalation.” Reuters interpreted the message as potentially indicating that the group was backing down. (Reuters)
Whether that represents a permanent change or a temporary reaction to law-enforcement pressure remains unclear.
What Businesses and Investors Should Watch
Although the story is primarily a cybersecurity and law-enforcement development, it also has implications for businesses and investors.
Companies holding large amounts of customer or employee data face increasing regulatory, operational and reputational risks from cyberattacks. A major breach can result in investigation costs, litigation, business disruption and loss of customer confidence.
For investors, the wider lesson is that cybersecurity is increasingly becoming a core business risk rather than simply an IT expense.
Companies with strong security controls, effective incident-response plans and limited exposure to unnecessary data collection may be better positioned to manage these risks. Conversely, repeated breaches can increase costs and potentially damage a company's competitive position.
The latest ShinyHunters investigation also shows why international cybercrime enforcement could become an important theme for cybersecurity companies, government agencies and businesses operating across borders.
What Happens Next?
The next major developments are likely to come from the investigation itself.
Authorities will need to determine Khader's precise role, assess the information obtained from his devices and communications, and establish whether his cooperation leads to additional arrests.
Investigators will also continue examining the alleged FBI breach and determining exactly what information was accessed, how the intrusion occurred and whether the hackers still possess usable copies of the stolen data.
For now, the detention is best viewed as a significant development in an ongoing investigation rather than evidence that the ShinyHunters network has been dismantled.
Conclusion
The reported detention of Saif al-Din Khader, an alleged ShinyHunters member known online as “Rey,” in Jordan could provide U.S. and international investigators with a valuable new source of information. Two sources told Reuters that he is cooperating with the FBI to help identify other hackers, while the FBI has confirmed that its broader investigation remains active. (Reuters)
With another alleged member already detained in the Netherlands and ShinyHunters' online operations showing signs of disruption, pressure on the group appears to be increasing. The key question now is whether Khader's reported cooperation leads to further arrests and helps investigators establish the full scope of the alleged FBI data breach.
Follow our blog for more cybersecurity, technology, business and global market updates.
This article is for informational and educational purposes only and should not be considered investment advice.