ShinyHunters Hacker Detained in Jordan, Sources Say

ILLUSTRATIVE IMAGE — Close-up of hands holding handcuffs, symbolizing punishment and crime

WASHINGTON — October 5, 2026

A suspected member of the ShinyHunters hacking group has been detained in Jordan and is cooperating with U.S. investigators, according to three people familiar with the matter.

Saif al-Din Khader, whose alleged hacker nickname is Rey, was detained by Jordanian authorities this week, the sources said. Two of them said he was taken into custody on Tuesday, although the circumstances of his detention and his current location were not immediately clear.

Two sources said Khader is cooperating with the FBI and other law enforcement agencies to help identify and locate other suspected members of ShinyHunters. One source said he has been showing investigators information from his electronic devices and digital communications.

The FBI did not confirm Khader's detention or comment on any specific overseas operation. The bureau said it continues to investigate the recent cyber incident involving ShinyHunters and is working with international partners to pursue those responsible.

ShinyHunters is a cyber extortion group known for stealing data from major organizations and demanding money from victims. The group recently claimed that it had obtained data on every FBI employee, prompting U.S. authorities to investigate the alleged breach.

An analysis of a sample of the stolen material found extensive personal information about FBI employees, including details about their jobs as well as medical and psychiatric information. The information could create serious risks for affected employees if it is genuine and misused.

Khader's reported cooperation could help investigators determine how the hackers obtained the information and identify other people involved. Reuters was unable to independently verify the full scope of his cooperation.

The case has developed as ShinyHunters appears to have faced increasing disruption. The group's previous communication channel became unreachable, while its dark web site disappeared after the FBI issued a deadline related to the investigation.

FBI Director Kash Patel had indicated that additional arrests could follow the detention of another alleged ShinyHunters member, Pepijn van der Stap, in the Netherlands. The FBI has not publicly identified Khader as the person detained in Jordan.

ShinyHunters previously claimed it targeted the FBI in retaliation for a U.S. cybercrime advisory that accused the group of exaggerating its access to stolen information. More recently, people operating an account linked to the group told Reuters they did not want further escalation with the FBI.

Khader's alleged connection to the hacking community was already known among cybersecurity researchers. He was previously identified as a member of Scattered Lapsus$ Hunters, an umbrella group associated with several prominent hacking groups.

ShinyHunters has continued to claim responsibility for major cyberattacks in 2026, including attacks involving Rockstar Games and education technology company Canvas. Law enforcement agencies have faced difficulties prosecuting members of related hacking groups because of their young ages, loosely organized structures and the reluctance of some victims to cooperate with investigations.

The investigation into the alleged FBI data theft remains ongoing. Khader's detention and reported cooperation could provide investigators with new information about the group and the extent of the data compromise.