ShinyHunters member detained in Jordan, cooperating with FBI in data theft investigation

Detention and cooperation

Jordanian authorities detained Saif al-Din Khader, a key member of the ShinyHunters hacking group, according to three people familiar with the matter. Two sources said he was taken into custody on Sept. 29. Reuters could not immediately determine the circumstances of the detention or Khader's current whereabouts. His alleged hacker nickname is Rey.

Two sources said Khader is helping the FBI and global law enforcement locate other hackers in the group. One source said he was guiding investigators through his electronic devices and digital correspondence. The source described his cooperation as critical to efforts to arrest the other hackers.

Alleged theft of FBI employee data

ShinyHunters claims to have stolen data on every FBI employee. A Reuters analysis of a sample shared by the group found extensive personally identifiable information, sensitive job role details, and psychiatric and medical information. The claimed scale of the theft has drawn comparisons with the allegedly Chinese-linked intrusion at the US Office of Personnel Management in 2015, which compromised sensitive information on millions of Americans vetted for security clearances.

Experts believe ShinyHunters consists mainly of young, English-speaking hackers focused on data theft and extortion. The group has a long history of targeting major corporations worldwide, although the extent of the claimed FBI employee data theft had not been independently established in full.

Disruption and continued arrests

There have been signs of disruption in ShinyHunters' operations. Beginning on Sept. 29, Reuters was unable to reach the group through an online account it had previously used to communicate with journalists. On Sept. 30, the group's dark web site, which had previously posted threats against the FBI, disappeared. The timing did not establish whether Khader's detention caused either development.

The FBI declined to discuss any specific arrest or overseas activity but said it continues to aggressively investigate the alleged ShinyHunters incident. The bureau said it had worked with partners to arrest multiple subjects. Another alleged ShinyHunters member, Pepijn van der Stap, had been detained in the Netherlands. FBI Director Kash Patel said on Sept. 30 that teams were working new leads and that more arrests were possible.

Sources: Bleepingcomputer