Story perspectives

FBI arrests ShinyHunters suspect, more raids likely

By Drooid · Oct 5, 2026, 2:23 AM UTC · How we work

Summary

Jordanian authorities detain

Jordanian authorities detained Saif al-Din Khader, a suspected ShinyHunters member, on September 29.
Khader is cooperating with the FBI and has handed over devices and correspondence to locate other members.
ShinyHunters claims it stole 2-3 terabytes of data on every FBI employee through an Oracle PeopleSoft flaw.
FBI Director Kash Patel said more arrests are on the table after Pepijn van der Stap’s detention in the Netherlands.

Summary

ShinyHunters Breach SaaS

ShinyHunters used stolen SSO credentials to breach SaaS platforms like Salesforce and Snowflake.
The group bypassed malware by exploiting MFA gaps resisting phishing to reach vendor environments.
A hacker’s DDoS attack forced ShinyHunters to shut its dark-web leak site for upgrades.
Researchers linked ShinyHunters’ origins to TheDarkOverlord and GnosticPlayers, noting its 2020 brand emergence.
The FBI warned the group has extorted over $70 million from more than 140 victims.

History

Historical Context

During the November-December 2013 Target breach, hackers stole credit-card data from about 40 million shoppers by hijacking credentials of HVAC vendor Fazio Mechanical Services, exposing the danger of supply-chain attacks. Today, the ShinyHunters group exploits Oracle PeopleSoft and SaaS flaws using the same vendor-credential method, prompting the FBI to step up arrests and regulators to tighten cloud-security oversight.

1 of 3

Jordanian authorities detain

Jordanian authorities detained Saif al-Din Khader, a suspected ShinyHunters member, on September 29.
Khader is cooperating with the FBI and has handed over devices and correspondence to locate other members.
ShinyHunters claims it stole 2-3 terabytes of data on every FBI employee through an Oracle PeopleSoft flaw.
FBI Director Kash Patel said more arrests are on the table after Pepijn van der Stap’s detention in the Netherlands.

1 / 3