IC Operations & Tradecraft — 2026-10-04

ShinyHunters Hacker Detained in Jordan and Reportedly Cooperating With FBI to Identify Group Members After Alleged Bureau Data Breach

BLUFKhader's reported cooperation gives the FBI a roadmap into ShinyHunters' network, but additional public arrests or charges by early November remain unlikely given cross-jurisdictional friction and the group's continued operations.

Reuters, citing three people familiar with the matter, reported on October 3 that Saif al-Din Khader, alleged to be the ShinyHunters member "Rey," was detained in Jordan. Two of the sources said he was taken into custody Tuesday and is helping the FBI and international law enforcement locate other members 123. One source told Reuters Khader is walking investigators through his devices and communications, and Reuters could not establish why he was held or where 23. The FBI declined to confirm any specific arrest but said it has worked with partners to arrest multiple subjects in its investigation of the incident 2. BleepingComputer reported that ShinyHunters' leak site went offline Tuesday and a new one appeared Thursday, while the group has not responded to its inquiry about the detention 3.

Analysis
Additional ShinyHunters arrests announced by November 4 are unlikely, even if Khader is walking investigators through his devices and communications. Device review identifies suspects faster than it produces charges, and the group's new leak site shows operations continuing under other members. The Dutch arrest on September 15 and the Jordan detention suggest the FBI is working through partners, which can delay public confirmation in foreign jurisdictions. Confidence is moderate because every report traces to one anonymously sourced Reuters exclusive, and the FBI has confirmed neither Khader's arrest nor his role. The FBI's statement that it has already arrested multiple subjects could instead presage a rapid, coordinated announcement of more arrests. Defenders should plan for ShinyHunters extortion to continue at current tempo, while confirmed arrests would signal that Khader's cooperation is yielding leads and raise the risk of retaliatory leaks.

5 sources

Exclusive-ShinyHunters Hacker in FBI Data Theft Detained in Jordan, Cooperating With Bureau, Sources Say - Reuters (via U.S. News)
ShinyHunters Member Detained in Jordan, Reportedly Helping FBI Identify Fellow Hackers - Cyber Security News
ShinyHunters hacker reportedly detained in Jordan, aiding FBI - BleepingComputer
ShinyHunters hacker "Rey," allegedly involved in FBI data theft, detained in Jordan - DataBreaches.Net
Exclusive-ShinyHunters Hacker in FBI Data Theft Detained in Jordan, Cooperating With Bureau, Sources Say - Reuters