ShinyHunters Hacker Arrested in Jordan, Cooperating With FBI

A prominent ShinyHunters hacker has been arrested in Jordan and is now cooperating with the FBI to identify other members of the notorious data-theft collective, according to three sources cited by Reuters on October 3, 2026. The suspect, Saif al-Din Khader, was taken into custody by Jordanian authorities earlier this week, and two sources say he is helping investigators track down his former associates.

Who is Saif al-Din Khader?

The detained suspect is Saif al-Din Khader, a Jordanian hacker who operates under the alias “Rey” inside ShinyHunters. Jordanian authorities took him into custody on Tuesday, October 1, 2026, according to two of the Reuters sources. His current location and the exact circumstances of his detention have not been disclosed.

Investigative journalist Brian Krebs previously reported that Khader, described as a teenage hacker from Jordan, had recently become the leader of ShinyHunters—or was trying to claim that role. Khader reportedly clashed with Dutch member Pepijn van der Stap cybercrime case over who controlled the group.

What is ShinyHunters?

ShinyHunters is a cybercrime brand that first surfaced in early 2020, when it offered data from what it claimed were tens of millions of accounts for sale on the dark web. The group’s dark web site says it has been active since 2019. Cybersecurity experts say ShinyHunters should be viewed more as a brand name than a fixed group, since the people operating under the label may have changed over time.

The group has been linked to breaches involving Snowflake customers, AT&T, Ticketmaster, Telefónica, Orange, and Jaguar Land Rover, among others. In 2026 alone, researchers estimate the group’s extortion demands could reach $100 million, according to BleepingComputer.

FBI breach and cooperation

The arrest follows ShinyHunters’ claim in late September 2026 that it had breached FBI systems and obtained data on thousands of employees and job applicants. The group said the intrusion was a response to an FBI advisory in May 2026 that described ShinyHunters’ methods and advised victims not to pay ransoms.

Two sources told Reuters that Khader is now helping the FBI track down other ShinyHunters members, walking investigators through his devices and communications. The FBI declined to comment on a specific arrest or overseas operations but said in a statement that it is “relentlessly investigating” the recent cyber incident linked to ShinyHunters.

“We will use every available resource to hold accountable anyone responsible,” the FBI said, adding that multiple suspects have already been detained in cooperation with international partners.

Dutch arrest and group fallout

On Monday, September 15, 2026, Dutch police arrested 24-year-old Pepijn van der Stap, also known as “Umbreon,” on suspicion of involvement with ShinyHunters. Van der Stap was convicted in 2023 for data theft and extortion and had been released in December 2025. A court ordered him held for 90 days.

After the arrests, ShinyHunters’ infrastructure briefly went offline and associates went silent, though a new leak site appeared days later. The group’s internal power struggle between Khader and Van der Stap has become a key focus for investigators examining cyber extortion group leadership.

Impact and implications

The cooperation of a senior ShinyHunters figure could give the FBI unprecedented access to the group’s operations, membership, and infrastructure. It also highlights the growing pressure on cybercrime collectives as international law enforcement agencies coordinate arrests across borders.

Still, experts caution that ShinyHunters operates as a loose brand, and the arrest of one individual does not necessarily dismantle the network. ransomware and data extortion trends continue to evolve rapidly, making sustained international cooperation essential.

FAQ

Who is the ShinyHunters hacker arrested in Jordan?

Saif al-Din Khader, also known by the alias “Rey,” was detained by Jordanian authorities on October 1, 2026, according to Reuters sources.

Is the hacker cooperating with the FBI?

Yes. Two sources told Reuters that Khader is cooperating with the FBI and helping identify other ShinyHunters members.

What did ShinyHunters claim to steal from the FBI?

The group claimed to have accessed FBI systems and obtained personal data on thousands of employees and job applicants, including Social Security numbers and psychiatric records.

Was anyone else arrested in the ShinyHunters investigation?

Dutch police arrested Pepijn van der Stap, also known as “Umbreon,” on September 15, 2026, for his alleged involvement with the group.

What is ShinyHunters?

ShinyHunters is a cybercrime collective known for large-scale data theft and extortion, active since at least 2019 and linked to breaches at AT&T, Ticketmaster, and Snowflake customers.