Alleged ShinyHunters Member Arrested in Jordan Aids FBI

Saif al-Din Khader, apprehended by Jordanian authorities on September 29th, is now helping the FBI pursue other members of ShinyHunters. This extortion group recently claimed responsibility for stealing data from all FBI employees, including medical and psychiatric records.

Three individuals familiar with the case confirmed Khader's arrest to Reuters yesterday, without specifying his location. Two sources indicated that Khader is cooperating with the FBI, guiding investigators through his electronic devices and digital communications to trace his accomplices.

The hackers stated they breached the bureau's recruitment portal by bypassing the firewall protecting its Oracle PeopleSoft server. An analysis of the data sample by the news agency revealed that the stolen files contained sensitive medical and psychiatric information on agents, along with details concerning the functions of certain employees.

FBI investigators can now rely on Saif al-Din Khader to help mitigate or at least understand the damage, as ShinyHunters members have evaded capture for years.

Before Khader's apprehension, Dutch police arrested a 24-year-old man in Amsterdam on September 15th in connection with a ShinyHunters investigation. This individual was identified as Pepijn van der Stap by journalist Brian Krebs and the site DataBreaches. Seven days later, the group claimed the intrusion into FBI systems, stealing between 2 to 3 TB of data. ShinyHunters described this hack as retaliation for an FBI notice. In that notice, the bureau accused the group of exaggerating their access to extort money from victims, giving the hackers one week to retract the statement.

Following the arrest in the Netherlands, Brett Leatherman, deputy director of the FBI's cyber division, urged other group members to surrender. "The longer you stay out there, the more we learn about you. I'd suggest you make first contact while you still have a choice," he warned.

On Tuesday, September 29th, the day Saif al-Din Khader was reportedly detained, an alleged ShinyHunters affiliate closed their messaging account, and the group's main spokesperson stopped responding to Reuters and BleepingComputer journalists. The next day, the group's dark web site went offline. FBI Director Kash Patel noted on X that "more arrests are possible."

When contacted, the bureau declined to comment on specific arrests but vowed to "spare no effort to bring to justice each responsible party." In their final email to Reuters, the ShinyHunters operators adopted a conciliatory tone. "We do not wish for escalation," they wrote, adding that the agency could understand if "ShinyHunters gives up completely." However, on Thursday, October 1st, a new data leak site was launched under the group's name, suggesting other members likely continue their extortion activities, according to BleepingComputer.

Saif al-Din Khader has been linked to several data leaks dating back to early 2025. In February of that year, he released 6.5 GB of documents stolen from Orange's Romanian subsidiary. At the time, he was part of the HellCat ransomware group but claimed to BleepingComputer that he conducted the attack alone. The hacker later gained administrator rights on Telegram channels for Scattered Lapsus$ Hunters. ShinyHunters is part of this collective, which emerged in 2025 and whose members claimed responsibility for the cyberattack on Jaguar Land Rover in September of that same year. The manufacturer had to halt production for weeks, incurring costs exceeding $220 million.

Two months later, Brian Krebs identified the hacker after analyzing infostealer logs and communicating with him on Signal. According to the journalist, Saif al-Din Khader was 15 years old and living in Amman, Jordan. He asserted he had distanced himself from the group. "I am already cooperating with law enforcement. In fact, I've been talking to them since at least June," he wrote, though Brian Krebs could not verify these claims.

Despite this, ShinyHunters continued its attacks in 2026. In April, the group stole millions of commercial documents from Rockstar Games, then targeted the educational platform Canvas, disrupting classes for thousands of American schools in May. Law enforcement agencies worldwide have struggled for years to apprehend members of these groups. Pursuing charges against such young hackers is complex, sources told Reuters, especially since extortion victims often refuse to cooperate with investigators.