Jordan detains suspected ShinyHunters member over FBI data breach
In short
Jordanian authorities have detained Saif al-Din Khader, a suspected member of the ShinyHunters hacking group, which said in September it had stolen data belonging to current and former FBI employees, according to Reuters and CBS News. Two Reuters sources said he was taken into custody on 29 September and is cooperating with investigators, helping them examine his devices and correspondence. The FBI declined to comment on the detention but said it is continuing to investigate the incident together with partners.
Read the full story 2 min read
Jordanian law enforcement detained Saif al-Din Khader, a suspected member of the ShinyHunters hacking group, which said in September that it had stolen data belonging to current and former FBI employees. Kommersant reported the detention citing Reuters, and Interfax reported it citing CBS News and US officials. Two Reuters sources told the agency, according to 3DNews, that Khader was taken into custody on Tuesday, 29 September. [ 1 , 2 , 4 ]
According to sources cited by Reuters, Khader agreed to cooperate with the authorities and is helping identify other hackers involved in the attack; one source said he is helping investigators examine his electronic devices and digital correspondence to establish the whereabouts of other members. The FBI declined to confirm or deny the detention or comment on operations abroad, but said it had begun working with partners to detain suspects and is continuing to investigate the incident, adding that it would not spare resources to hold those involved to account. [ 1 , 2 , 4 ]
The claim at the centre of the case came from the group itself: ShinyHunters announced on 22 September that it had breached FBI systems and obtained information about employees' assignments as well as medical documents, Kommersant reported. Interfax, citing CBS News and US officials, said hackers broke into an online portal holding information about candidates for jobs at the FBI, and that the stolen data covered thousands of current and former employees and included social security numbers, emergency contact details and home addresses. Citing CNN sources, Interfax said data on FBI staff in secret units dealing with China and Russia was also taken. Reuters, analysing part of the material the group released, found personal details of FBI employees, confidential information about their duties, and medical and psychiatric data, 3DNews reported. [ 1 , 2 , 4 ]
There were also signs that the group's activity was disrupted. Kommersant, citing Reuters, said ShinyHunters stopped responding to journalists through its usual channels on 29 September and that its darknet site became unavailable the following day; Reuters reported that it had been unable to reach group representatives from Tuesday. Kommersant also noted that FBI Director Kash Patel had hinted that some members of the group could be detained, but that no official announcement was made. [ 1 , 2 ]
Kommersant described ShinyHunters as a group that appeared in 2020 and initially sold stolen databases on underground forums, becoming more sophisticated from 2025 and carrying out ransomware attacks. It said the group worked with other cyber groups such as Lapsus$ and Scattered Spider, so identifying the connections of one member could help investigators understand both ShinyHunters' structure and its ties to those partners. Experts cited by 3DNews describe such groups as made up mostly of young English-speaking hackers specialising in data theft and extortion, and Reuters noted that law enforcement faces difficulties in prosecuting them because they have no clear structure and victims do not always agree to cooperate. [ 1 , 2 ]
Why it matters
The detention gives investigators a rare opening into a loosely structured group that has attacked major companies worldwide, and one Reuters source said Khader's cooperation could help establish the scale of the FBI breach or limit the damage. Kommersant noted that prosecuting such groups is difficult because they lack a clear structure and victims do not always cooperate with investigations. Information he provides could also map ShinyHunters' contacts with partner groups named in the reports.
Key facts
- Jordanian law enforcement detained a suspected member of the ShinyHunters group in connection with the theft of FBI data. [ 1 , 2 , 3 , 4 ]
- The suspect is named as Saif al-Din Khader. [ 1 , 2 , 4 ]
- Two Reuters sources said he was taken into custody on Tuesday, 29 September. [ 2 ]
- The detained man has agreed to cooperate with investigators and is helping identify others involved in the attack, according to sources cited by Reuters and CBS News. [ 1 , 2 , 4 ]
- The FBI declined to confirm the detention but said it is continuing to investigate the incident and working with partners. [ 1 , 2 , 4 ]
- ShinyHunters said on 22 September that it had breached FBI systems and obtained data about employees' assignments and medical documents. [ 1 ]
- Interfax, citing CBS News and US officials, said data on thousands of current and former FBI employees was taken from a recruitment portal and included social security numbers, emergency contacts and home addresses. [ 4 ]
- Kommersant, citing Reuters, said the group stopped answering journalists on 29 September and its darknet site became unavailable the next day. [ 1 ]
Confirmed by several sources
- Jordanian authorities detained a suspected member of the ShinyHunters group in connection with the theft of FBI data. [ 1 , 2 , 3 , 4 ]
- The suspect is identified as Saif al-Din Khader. [ 1 , 2 , 4 ]
- The detained man is cooperating with investigators, according to sources cited by Reuters and by CBS News. [ 1 , 2 , 4 ]
- The FBI did not confirm the detention but said it continues to investigate the incident and is working with partners. [ 1 , 2 , 4 ]
- ShinyHunters said in September that it had stolen data belonging to current and former FBI employees. [ 1 , 2 , 4 ]
Still unclear
- The circumstances of Khader's detention, where he is being held, and his current situation are not known; Reuters said it could not reach him or his relatives. 3DNews is the only document to describe what Reuters could and could not establish; the other documents give no details.
- The number of affected FBI employees is reported differently: Interfax, citing CBS News, says data on thousands of current and former employees was taken, while 3DNews says the group claimed to have stolen data on all FBI employees. The figures come from different sources and the group's claim has not been independently verified in the documents.
- The pseudonym “Rey” attributed to Khader appears in only one report. Single-source detail reported by 3DNews on the basis of Reuters sources.
- Whether other suspects have been detained and who they are remains unconfirmed: the FBI said partners had secured several detentions, while Kommersant reported that no official announcement had been made. No names or details of further detentions were given in any document.
What local media are saying
Timeline, local time
- ShinyHunters announces it breached FBI systems and obtained data on employees' assignments and medical documents, according to Kommersant's account of the group's statement. [ 1 ]
- Jordanian authorities take Khader into custody, according to two Reuters sources cited by 3DNews. [ 2 ]
- Reuters can no longer reach ShinyHunters representatives through their usual online account, the agency reports. [ 1 , 2 ]
- The group's darknet site becomes unavailable, Kommersant reports, citing Reuters. [ 1 ]
- Kommersant publishes its report on the detention on 3 October, citing Reuters. [ 1 ]
- 3DNews reports the detention, citing three Reuters sources. [ 2 ]
- RIA Novosti reports the detention on 5 October. [ 3 ]
- Interfax reports the detention on 5 October, citing CBS News and US officials. [ 4 ]