Security News

ShinyHunters Under Pressure: Second Alleged Member Reportedly Detained in Jordan

The Record · 6 Oct 2026
Key Takeaway Arrests and takedowns do not guarantee a threat has gone away, so keep your defences, staff awareness and incident response plans current even when a group appears disrupted.

The FBI has reportedly detained a second person linked to ShinyHunters, the cybercriminal group behind several high-profile incidents, including a recent breach involving FBI information. Multiple FBI sources told Reuters that Saif al-Din Khader was arrested in Jordan on September 28 and is now cooperating with law enforcement to help locate other members. The FBI declined to comment on the arrest. It said it "continues to aggressively investigate" the incident and will "spare no resource" in bringing those responsible to justice.

Khader was identified last November by journalist Brian Krebs as a key figure in the group, who traced the username "Rey" and other hacker profiles back to him. Krebs reported that he was a 16-year-old living in Amman. He is reportedly linked to dozens of significant incidents affecting European and American companies. The FBI has not said where he is held or whether he will be extradited.

His arrest follows that of another alleged member. On September 29, the FBI and Dutch National Police announced the arrest of Pepijn van der Stap, who was released this year after serving a prison sentence for an earlier hacking conviction. Krebs reported that he and Khader were allegedly in a power struggle over control of the group. The ShinyHunters leak site was taken down last week, allegedly by law enforcement, but the group resurfaced on Telegram on Monday, claiming it was restarting a long-defunct cybercriminal forum as a replacement.

Summarised by CISO AI from The Record, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.