FBI Gets Inside ShinyHunters as Detained Hacker Helps Investigators Track Down His Own Crew

Three sources told Reuters that a suspected participant in the ShinyHunters cyber ring—which claims to have stolen data on every FBI employee—was detained in Jordan this week and is cooperating with the FBI to help identify and locate other hackers in the group.

Local authorities took Saif al-Din Khader into custody in Jordan, according to the three sources, with two confirming the detention occurred on Tuesday. While Reuters could not immediately verify the circumstances surrounding his capture or his current whereabouts, two of the sources noted that he is helping the FBI and global law enforcement locate other hackers in the group.

One source said Khader is walking investigators through his electronic devices and digital correspondence to help the FBI locate his cohorts. 'His cooperation is critical to ongoing efforts to arrest these hackers,' the source told Reuters.

While the bureau declined to discuss foreign arrests or specific operations, it stated that it 'continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects — and we will spare no resource in bringing each of the responsible individuals to justice.' Reuters' attempts to reach Khader and members of his family over the past week and a half were unsuccessful.

ShinyHunters Hacker Helps FBI Hunt Former Accomplices

Referred to online as 'Rey', Khader's apprehension marks a fresh development in the ongoing ShinyHunters saga. Security specialists believe the notorious digital extortion ring—infamous for hitting prominent global firms—primarily comprises young, English-speaking individuals whose main goals are stealing information and demanding ransom.

The group's claimed haul of data on every single FBI employee has drawn comparisons to the allegedly Chinese-linked 2015 breach at the US Office of Personnel Management, which compromised sensitive details on millions of Americans who had been vetted for security clearances.

A Reuters examination of a data sample provided by ShinyHunters showed that the files held detailed personal identifiers belonging to bureau personnel, sensitive job-role information, and psychiatric and medical information.

Reuters reported that Khader's cooperation could be critical to helping investigators contain—or at least understand—the damage. One source said he was walking investigators through his electronic devices and digital correspondence to help the FBI locate his cohorts.

ShinyHunters Faces Mounting Pressure After Claimed FBI Breach

For several days, signs suggested that ShinyHunters was facing disruption in the wake of its claimed break-in at the FBI. Starting on Tuesday, Reuters could no longer contact the syndicate via the online account it previously used to communicate with journalists, and by Wednesday, the collective's dark web portal—where it previously posted threats against the bureau—went offline.

Following the Dutch police apprehension of fellow suspect Pepijn van der Stap in the Netherlands, FBI Director Kash Patel had strongly signaled that further detentions were imminent. 'FBI teams are working new leads RIGHT NOW,' Patel stated in a Wednesday post on X, emphasizing that 'More arrests are on the table.'

International Law Enforcement Closes In on ShinyHunters

On Friday, the individuals running a digital mail account connected to ShinyHunters failed to reply to a request for comment. Earlier, those same operators informed Reuters that their portal went down because of rival sabotage and 'disruption due to an unrelated incident.'

The group had previously struck a defiant tone over the FBI incident, but in its most recent email to Reuters, its operators said they wanted 'no further escalation' with the bureau. They said Reuters could interpret the message as 'ShinyHunters backing down completely'.

With international law enforcement pursuing multiple suspects and ShinyHunters' digital infrastructure going offline, the group is facing mounting pressure. Whether Khader's cooperation marks the beginning of the end for ShinyHunters remains to be seen, but his access to electronic devices and digital correspondence could help investigators identify and pursue other alleged members.