Jordan detained an alleged ShinyHunters member tied to the FBI breach, and sources say he is now helping investigators map the rest of the group.
Story Snapshot
- Jordan detained Saif al-Din Khader, linked by sources to the alias “Rey.”
- Two sources say Khader is cooperating with the Federal Bureau of Investigation (FBI).
- U.S. outlets report his detention followed the group’s claim of defacing the FBI jobs site.
- Jordan acknowledged an arrest tied to ShinyHunters but did not name the suspect.
What investigators say happened and why it matters
Reuters reported that Jordanian authorities detained Saif al-Din Khader this week, and two sources said he was taken into custody on Tuesday. The same reporting links Khader to the hacker alias “Rey.” Two sources say he is helping the Federal Bureau of Investigation (FBI) and other agencies identify additional ShinyHunters members. The FBI declined to discuss details. The claims matter because the group said it hit the FBI’s jobs site and stole sensitive data.
CBS News echoed the detention and cooperation claims, citing U.S. officials. Their report ties the arrest to the group that claimed responsibility for defacing the FBI jobs website last month. The report states Jordanian authorities detained Khader this week. The outlet frames the development as part of an ongoing investigation into alleged ShinyHunters activity, with U.S. investigators pursuing leads on other members. These accounts align with the broader view of a live, cross-border probe.
How Jordan fits into a cross-border cybercrime case
Jordan’s state-linked press confirmed an arrest connected to ShinyHunters after the FBI data theft claims but did not publicly name the suspect. That approach is common early in cyber cases that span borders. Authorities often hold back identities while evidence is sorted and partners coordinate. Public clues then come from named media outlets citing sources. Here, multiple outlets point to Khader as the detained person, while officials keep formal statements narrow.
BleepingComputer summarized the Reuters reporting and identified “Rey” as Saif al-Din Khader. Their write-up described cooperation with the FBI to locate other members of the extortion group. While secondary, this mirrors the central account and adds technical framing for general readers. Security trade sites and tech press often provide this bridge, translating legal moves into plain language about group roles and tactics as cases unfold.
What is confirmed, what is alleged, and where the gaps remain
Confirmed facts are limited. Jordan confirms an arrest tied to ShinyHunters, but not the name. Major outlets report the name and the cooperation claim, citing multiple sources. The FBI has not named the suspect or described any plea or deal. That means the identity link to “Rey,” and the claim of active help, rest on sourced reporting rather than court filings. Readers should expect more formal records if charges, extradition, or indictments follow.
Suspected ShinyHunters hacker detained in Jordan
A suspected member of the ShinyHunters hacking group, which claimed to have stolen data on every FBI employee, was detained in Jordan and is reportedly cooperating with the FBI.
Reuters reports Saif al-Din Khader is helping U.S.…
— Cyber Security News (@CyberSecNews663) October 5, 2026
Even with open questions, the core stakes are clear. If a key insider is helping, investigators may move faster to identify accounts, servers, and partners. That could reduce future harm to citizens whose data is at risk. People on the right and left share this concern: they want law enforcement to protect them, but they also want transparency when cross-border detentions occur. Clear charges, due process, and public updates help build trust that power is used fairly.
What this means for public trust and government performance
Americans are tired of elite failures that leave them exposed to hacks, scams, and data theft. They blame politics, but the pain is the same when their records leak. If the government can quickly turn this detention into concrete results, it may ease doubts. Real wins look like arrests, seized infrastructure, and restored services. Real transparency looks like timely notices to victims and clear steps to prevent the next breach, not vague praise for “resilience.”
Sources:
cbsnews.com, reuters.com, internazionale.it