An alleged ShinyHunters member detained in Jordan is reportedly cooperating with the FBI and international law enforcement, according to people familiar with the matter, as investigators seek to identify other members of the data-extortion operation. The case follows the reported detention of a 24-year-old Amsterdam man in the Netherlands and an investigation into claims that ShinyHunters stole FBI employee data, defaced an FBI jobs portal and sought to pressure the agency over alleged false statements.
Key Points
- A suspected ShinyHunters member identified as Saif al-Din Khader was detained in Jordan on September 29, 2026, and is reportedly cooperating with investigators.
- Dutch authorities detained a 24-year-old Amsterdam man earlier in September in a separate investigation linked to the group.
- ShinyHunters claimed it accessed FBI systems and stole between two and three terabytes of data, but the FBI, Oracle and Amazon Web Services have not confirmed that account.
- Investigators are examining devices, communications, servers and access records to identify additional suspects and determine what data was accessed or removed.
Detentions and timeline
Saif al-Din Khader, who used the aliases “Rey” and “ReyXBF,” was taken into custody in Jordan on September 29, 2026. Reports published on October 3 and 4 said Khader was cooperating with the FBI and international law enforcement to help identify other alleged ShinyHunters members. One report said, “His cooperation is critical to ongoing efforts to arrest these hackers.”
Brian Krebs reported in November 2025 that Khader was Rey and that Khader had told him he had been cooperating with law enforcement since June 2025. The earlier account predates the reported Jordan detention and describes Khader’s claimed cooperation with authorities.
Dutch police detained a 24-year-old man from Amsterdam on September 15, 2026, in connection with an investigation into ShinyHunters. Multiple reports identified him as Pepijn van der Stap, who was known online as “Umbreon.”
Following Khader’s detention, ShinyHunters’ usual communication account and dark-web leak site were reported offline. A new leak site later reportedly appeared, leaving the group’s public-facing infrastructure in a changed state while the investigation continued.
What the FBI is investigating
ShinyHunters is described as a persistent data-theft and extortion brand that has operated through different members and operators. The group reportedly claimed that it stole FBI employee data and sought to pressure the bureau over alleged false statements.
Attackers defaced the FBI jobs portal at apply.fbijobs.gov. The FBI took the application service and Special Agent Applicant Portal offline while investigating unauthorized activity.
ShinyHunters claimed that it exploited an undisclosed Oracle PeopleSoft vulnerability that allowed code execution without authentication, moved into FBI-managed AWS GovCloud systems and downloaded between two and three terabytes of data. Oracle, Amazon Web Services and the FBI have not confirmed that attack path or the claimed volume of stolen data.
Journalists received a sample containing 5,000 alleged FBI employee records. The sample was described as containing names, home addresses, telephone numbers, Social Security numbers, birth dates, assignments and family details, while Reuters’ analysis reportedly found psychiatric and medical information as well. Reuters matched information in at least 10 cases, according to CybersecurityNews, but the provenance and full scope of the dataset remain under investigation.
Investigators seek more evidence
The detained suspect is reportedly showing investigators his devices and digital communications. Seized infrastructure and servers can provide additional leads, including information about associates, accounts and the group’s operating methods.
Investigators must compare server logs, account activity, cloud access records and outgoing data transfers to establish how attackers entered the environment and what information was removed. That work is also expected to help distinguish verified access from the attackers’ unconfirmed claims about the PeopleSoft vulnerability, AWS GovCloud systems and the volume of data.
The FBI has declined to comment on specific arrests. The bureau said it continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects — and it will spare no resource in bringing each of the responsible individuals to justice.
FBI Director Kash Patel said the investigation was producing new leads in a post on X:
“FBI teams are working new leads RIGHT NOW. More arrests are on the table.”
Kash Patel, FBI Director, FBI
Brett Leatherman, assistant director of the FBI’s Cyber Division, described the reported scale of activity linked to the cybercriminals:
“Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments.”
Brett Leatherman, Assistant Director, FBI Cyber Division
Leatherman also urged other alleged members to contact authorities before investigators identify them through arrests and seized infrastructure:
“Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you… I suggest you reach out first while the choice is still yours.”
Brett Leatherman, Assistant Director, FBI Cyber Division
A brand with changing operators
Security researchers at Sekoia and Beazley Security have described ShinyHunters as a brand or operating model rather than a single tightly organized group. Their analysis has also traced links to earlier extortion groups, providing context for why different actors may use the ShinyHunters name over time.
The reported detentions give investigators access to people, devices and infrastructure that may help connect aliases to real-world identities. Jordanian and Dutch authorities have worked with international partners, while the FBI continues efforts to determine the attack’s entry point, verify the claimed data theft and identify additional suspects.
The investigation remains active. The FBI jobs application services were taken offline during the response, the reported leak-site activity continued to change, and the attackers’ technical account and claimed data volume had not been independently confirmed by the organizations named in the claims.
About the Author
