One individual allegedly tied to the ShinyHunters hacking collective has been detained in Jordan and is reportedly assisting U.S. authorities in identifying other operatives linked to the group. The detainee is identified as Saif al-Din Khader, also known online as “Rey.” His custody reportedly began on Tuesday, September 29. {{}}
According to sources familiar with the case, Khader is working with the FBI and global law enforcement to help locate additional members of ShinyHunters. The FBI hasn’t publicly verified his detention or disclosed his location. Officials also declined to clarify how Khader might be involved with alleged incidents tied to the group. {{}}
Claims of a Major Breach Against the FBI
The report comes amid serious allegations that ShinyHunters accessed data involving every FBI employee. That accusation remains unverified. The group supposedly defaced the FBI’s recruitment site—apply.fbijobs.gov—displaying a fake seizure notice, an act that led to the AFP taking down the portal and its related Special Agent Applicant Portal while investigating unusual activity within its recruitment infrastructure. {{}}
ShinyHunters claims to have used an unreported vulnerability in Oracle PeopleSoft to gain access without authentication, then allegedly breached Amazon Web Services’ GovCloud systems to download between two and three terabytes of data. Neither Oracle, AWS, nor the FBI have confirmed those attack vectors. {{}}
The hackers shared a sample dataset of 5,000 records supposedly belonging to FBI employees, which included names, contact info, Social Security numbers, birth dates, assignments, and family details. In a partial verification, at least ten instances matched public info; but no conclusive proof shows the data came from FBI networks. {{}}
Law Enforcement Response and Outstanding Questions
The FBI has refused to comment on the specific arrest or an overseas operation, but says it is actively investigating the alleged ShinyHunters incident. The bureau notes it has already helped arrest several suspects connected to the case and pledged to hold all responsible parties accountable. {{}}
This detention follows another recent development: on September 15, Dutch authorities detained a 24-year-old suspect in Amsterdam alleged to be a ShinyHunters leader. The suspect’s ties to the group remain unproven and were denied by individuals associated with them. {{}}
Experts describe ShinyHunters as a mostly young, English-speaking group focused on data theft and extortion. The significance of Khader’s detention hinges on what he actually provides—how he is linked to the FBI breach claims, what data or identity-mapping he offers, and whether allegations of data theft are true. {{}}
For now, key elements remain murky: the extent of any legal process in Jordan, whether Khader’s cooperation yields new arrests or evidence, and whether the public claims by ShinyHunters reflect what actually occurred. Investigators will need to verify through logs, cloud records, and other technical forensic evidence. {{}}
As the FBI continues its probe, clarity around Khader’s role, the validity of the breach claims, and any real impact to FBI systems remain the central questions.
Analysis: Khader’s detention signals a rare inside opportunity for law enforcement to map a largely shadowy hacking network. If he provides usable intelligence, it could lead to cross-border arrests and give better insight into how ShinyHunters operates. At the same time, claims of a total breach of FBI staff data should be treated with caution until independently verified—propaganda and exaggeration remain common in such incidents. What unfolds will test both investigative agility and cyber attribution standards in law enforcement today.
