Jordanian authorities detained Saif al-Din Khader this week, a suspected member of the ShinyHunters hacking group who is now cooperating with FBI investigators. The arrest marks a development in the global effort to dismantle the criminal network responsible for breaching over 140 organizations since 2025.

The Federal Bureau of Investigation addressed the broader campaign against the group in a statement. "The Bureau continues to aggressively investigate the recent Cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects and we will spare no resource in bringing each of the responsible individuals to justice," the FBI said.

FBI cyber division head Brett Leatherman stated that ShinyHunters has breached over 140 organizations and extorted $70 million in ransom since 2025. The group's activities have resulted in substantial financial damage, including $220 million in losses to Jaguar Land Rover in September 2025 by disrupting production through a cyberattack.

Khader has a documented history of involvement in major data breaches prior to his detention. In January 2025, he was linked to a breach of Telefónica's Jira system where 2.3GB of data was stolen, according to reports. He was also implicated in a February 2025 cyberattack on Orange's Romanian operations, where 6.5GB of data was leaked. Independent journalist Brian Krebs identified Khader as a key administrator of Scattered Lapsus$ Hunters, an umbrella group combining ShinyHunters, Lapsus$, and Scattered Spider, in November 2025.

Krebs also reported that Khader admitted to cooperating with law enforcement since June 2025. In a November 2025 interview, Khader claimed to have told authorities nearly everything about his activities. This cooperation predates his physical detention in Jordan but aligns with current efforts to identify remaining group members.

The FBI had previously arrested other suspects associated with the group. Pepijn van der Stap, a 24-year-old from Amsterdam, was arrested on Sept. 15 on suspicion of being a member of ShinyHunters. Van der Stap was in custody days before ShinyHunters announced it had hacked the FBI jobs website, a breach first reported on Sept. 22 by 404 Media.

"Van der Stap had 'no association' with the group and that Dutch police were incompetent," ShinyHunters said. The group also claimed responsibility for defacing the FBI's website last month, asserting it stole 2 to 3 terabytes of data related to FBI workers. ShinyHunters claimed to have used a new vulnerability with Oracle PeopleSoft to access the FBIJobs.gov portal and asserted without public verification that it obtained data on every FBI employee.

Why It Matters

The detention of Saif al-Din Khader represents a critical step in disrupting ShinyHunters, a black-hat criminal hacker and extortion group active since 2025. With Khader cooperating to locate other members, law enforcement agencies may gain insight into the operational structure of a group that has caused hundreds of millions in damages across multiple sectors. The scale of the threat is evident in the $70 million in extorted ransom and the breach of over 140 organizations since 2025.

This case shows the international coordination required to combat cybercrime, involving authorities in Jordan, the United States, and Europe. The previous arrest of Pepijn van der Stap and the ongoing investigation into the FBI website breach demonstrate the persistent nature of the threat. Khader's alleged role as an administrator in multiple hacking umbrellas, including Scattered Lapsus$ Hunters, suggests that his cooperation could lead to further arrests and a deeper understanding of how these groups collaborate.

What's New

Additional reporting has provided specific details regarding the timing and identity of the suspect. Securityaffairs.com cited two sources placing the arrest on Tuesday.

It was reported that two U.S. officials and another source with knowledge of the matter confirmed the detention.

Further context emerged regarding prior law enforcement actions and Khader's digital footprint. The FBI confirmed in September 2026 that it had already arrested multiple ShinyHunters suspects prior to Khader's detention, including Dutch national Pepijn van der Stap in September 2026. Research titled "What are ShinyHunters, the hackers that attacked Google? Should we all be worried?" was published in 2025.

BleepingComputer also linked Khader, using the alias Rey, to a January 2025 breach of Telefónica's Jira system where 2.3GB of data was stolen.