Suspected ShinyHunters hacker detained in Jordan, cooperating with FBI, sources say

A suspected member of the ShinyHunters hacking group tied to the claimed theft of FBI personnel data was detained in Jordan this week and is cooperating with U.S. investigators, three people familiar with the matter told Reuters on Saturday.

What the FBI says: The bureau declined to comment on any specific arrest abroad. In a statement carried by Reuters, it said it “continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects,” and that it “will spare no resource in bringing each of the responsible individuals to justice.” Reuters said attempts to reach Khader and his family were unsuccessful.

The broader case: In September, ShinyHunters claimed it breached FBIJobs.gov and stole roughly 2 to 3 terabytes of employee and applicant data. The FBI said it was investigating and that the entry point — a third-party provider or FBI systems — was still undetermined. Reuters later said a sample it reviewed included personally identifiable information, sensitive job-role detail, and psychiatric and medical information. Those volume and “every employee” claims remain the group’s assertions unless the bureau confirms scope.

Other arrests and disruption: Dutch police, working with the FBI, earlier detained Pepijn van der Stap, a 24-year-old Amsterdam man described by FBI Director Kash Patel as an alleged ShinyHunters leader, Fox News and CBS reported. After that case became public, Assistant Director Brett Leatherman released a video warning remaining members that “we know how to find you,” NPR reported. Reuters said ShinyHunters’ usual press channel went quiet after Tuesday and that the group’s dark-web site disappeared Wednesday. Patel posted that FBI teams were working new leads and that “more arrests are on the table.”

The group’s latest tone: Operators of a ShinyHunters-linked email told Reuters the site went offline because of rival sabotage and an “unrelated incident.” In a later message, they said they “want no further escalation” and that Reuters could read that as “ShinyHunters backing down completely.” They did not respond to a Friday request for comment on the Jordan report, Reuters said.

Sat Oct 3 update. Lead is a Reuters exclusive based on three unnamed sources; FBI declined to confirm the specific Jordan detention. Treat Khader’s role, nickname Rey, and cooperation claims as attributed. Breach volume (2–3 TB) and “every FBI employee” remain the group’s claims; Reuters has said samples it reviewed included employee PII, job-role detail, and medical information. Circumstances of detention and current location unknown. Dutch arrest of Pepijn van der Stap is separately reported (Fox, CBS, NPR) and preceded some public breach reporting. Re-check 1:56 PM PT: still Reuters-only on Jordan; added BleepingComputer/Krebs background (Khader said in 2025 he had been talking to law enforcement since June). Bullet removeIds set to oldest tech item Broadcom to lend Anthropic up to $42 billion for chip leases, filing says because the article's bullet was no longer in the tech briefing (keeps 10).