Jordan has confirmed the arrest of a suspected member of the ShinyHunters hacking group, which claims to have stolen data on every FBI employee, after reports of his detention in the kingdom.
State television quoted an official on Saturday as saying that "investigations are ongoing with the suspect about the activities of the group and the groups it is connected with". The official said the arrest took place last week, without giving details of his identity.
The kingdom is a close ally of the US and American security personnel are based in the country. The detention, first reported by Reuters, is the latest development in the case of ShinyHunters. The cyber extortion group, which has long targeted major corporations worldwide, is believed by experts to consist mainly of young, English-speaking hackers focused on data theft and extortion.
Reuters, quoting three people familiar with the case, named the suspect as Saif Al Din Khader, whose alleged hacker nickname is Rey. The report said he was cooperating with the FBI. Two of the sources said he was helping US and global law enforcement agencies locate the group's other hackers.
Khader’s identity, and his alleged connection to ShinyHunters, have long been known to security researchers. Last year, the independent journalist Brian Krebs reported that Khader was a key member of Scattered Lapsus$ Hunters, an umbrella group of hackers that included ShinyHunters. Krebs, who said he spoke to Khader over Signal, quoted the teenager, as saying he had quit the world of data breaches and extortion and was cooperating with law enforcement.
But ShinyHunters continued its hacking spree into 2026, claiming credit for break-ins at video game developer Rockstar Games, maker of "Grand Theft Auto", and a May intrusion involving education platform Canvas that caused widespread disruption across US schools.
FBI Director Kash Patel had been hinting at more arrests following the announcement that another alleged ShinyHunters member, Pepijn van der Stap, had been detained in the Netherlands. “FBI teams are working new leads RIGHT NOW,” Patel said on Wednesday in a message posted to X. “More arrests are on the table.”
FBI probe
The FBI declined to comment on any specific arrest or activity in Jordan. It said the bureau "continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters... and we will spare no resource in bringing each of the responsible individuals to justice."
The group's claimed theft of large amounts of data on every single FBI employee has drawn comparisons to the allegedly Chinese-linked intrusion at the US Office of Personnel Management in 2015. The 2015 intrusion compromised details on millions of Americans who had been vetted for security clearances.
A Reuters analysis of a sample of the data shared by ShinyHunters found it contained extensive personally identifiable information on FBI employees, sensitive job role information, and psychiatric and medical information.
Khader's cooperation with investigators was critical to containing the damage. One source said he was showing investigators his electronic devices and digital correspondence to help the FBI locate his cohorts.
"His cooperation is critical to ongoing efforts to arrest these hackers," the source told Reuters.
There have been hints in recent days that ShinyHunters was experiencing disruption following its announcement of the FBI break-in. On Wednesday, the group’s dark web site, where it had previously posted threats to the FBI, disappeared.
The operators of a ShinyHunters-linked email address did not respond to a request for comment on Friday. The operators of that account previously told Reuters that the group’s site had gone offline because of sabotage by rivals and "disruption due to an unrelated incident".
