Full Breakdown
Jordan Detains Suspected ShinyHunters Hacker Saif al-Din Khader
By Drooid · · How we work
The Detention and Cooperation
Jordanian authorities took Saif al-Din Khader into custody on September 29, 2026. Khader, known online as “Rey,” is cooperating with the U.S. FBI and other agencies, providing his devices and digital correspondence to help locate other ShinyHunters members.
Background: ShinyHunters’ Claims and Prior Arrests
ShinyHunters, a loosely organized network of young, English-speaking hackers, claimed in September 2026 that it had stolen 2–3 TB of data covering “every FBI employee.” The group posted a defacement on the FBI’s jobs portal and released a sample of roughly 5,000 alleged personnel records. Reuters could verify a subset of the data but could not confirm its source.
Earlier that month, Dutch police detained a 24-year-old suspect from Amsterdam—identified as Pepijn van der Stap—on September 15, 2026. ShinyHunters denied any link to him. Their dark-web site disappeared on September 22, 2026, which the operators blamed on rival sabotage.
Timeline of Key Developments
- Sept 15, 2026 – Dutch police arrest Pepijn van der Stap.
- Sept 22, 2026 – ShinyHunters’ dark-web site goes offline.
- Sept 29, 2026 – Jordan detains Saif al-Din Khader (“Rey”).
- Oct 3, 2026 – Reuters reports the Jordan detention.
- Oct 4, 2026 – CBS News confirms the arrest and the group’s claim.
Data and Claims at Issue
- Claimed volume: 2–3 TB of FBI employee information.
- Sample: ~5,000 records with names, addresses, SSNs, job titles, and medical details.
- Verification: Unverified; Reuters matched a subset but could not confirm origin.
- Group activity: Breaches of more than 140 organizations and extortion payments of at least $70 million since 2025.
Official Statements & Responses
- The FBI declined comment on the Jordan arrest.
- A Jordanian state-media official said investigations are ongoing.
- FBI Director Kash Patel said “FBI teams are working new leads RIGHT NOW.”
Verbatim Quotes
- “FBI teams are working new leads RIGHT NOW,” — Kash Patel, FBI director
- “Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments," Brett Leatherman, assistant director of the FBI's cyber division, said in a recorded statement.” — Brett Leatherman, division assistant director
Conflicting Reports & Gaps
- Breach extent: The claim of accessing “every FBI employee” remains unverified.
- Website outage: Operators cite sabotage; other sources suggest law-enforcement pressure.
- Legal status of Khader: No formal charges disclosed; the FBI has not confirmed the detention’s legal basis.