A Suspected ShinyHunters Member Is Reportedly Helping the FBI
Matthew Leo · Published October 9, 2026 · News
A suspected member of the ShinyHunters hacking group has been detained in Jordan and is reportedly helping investigators locate other hackers.
The wording matters. Jordan has confirmed an arrest and an ongoing investigation, but it has not publicly confirmed every detail reported about the suspect. There is no announced conviction, and the allegations should not be treated as one.
What has been reported
Reuters, citing three people familiar with the matter, identified the suspect as Saif al-Din Khader. The report says he is known online as “Rey” and was detained by Jordanian authorities. Two sources said he is helping the FBI and other law-enforcement agencies locate additional hackers.
The FBI declined to discuss a specific arrest. It said it continues to investigate the recent incident allegedly involving ShinyHunters and has worked with partners to arrest multiple subjects.
A Jordanian official, quoted by state television, confirmed that a suspect had been arrested and that investigators were examining the activities of the group and connected groups. The National reported that confirmation on October 4. The official statement did not independently confirm Khader’s identity or cooperation with the FBI.
The FBI data claim remains partly unverified
ShinyHunters has claimed it stole data concerning every FBI employee. Reuters examined a sample and found personally identifiable information, job details and medical and psychiatric information. That supports the seriousness of the exposed material, but it does not independently prove the group’s claim about complete coverage.
Reuters also reported that the group’s dark-web site disappeared and that its usual communication channel went silent. Operators later said they wanted no further escalation with the FBI. A missing site can indicate disruption, an internal dispute or a deliberate retreat; it is not proof that the group has been dismantled.
Why cooperation could matter
Cyber-extortion crews often operate as loose networks rather than conventional companies. Participants move between names, share access and recruit through online communities. That makes a cooperating insider potentially more valuable than simply seizing one server.
Device records and communications could help investigators connect aliases to people, identify infrastructure and separate core operators from affiliates. Any evidence would still need to be authenticated and tested through the legal process.
The lesson for Canadian organizations
ShinyHunters and related groups have repeatedly focused on identity systems, support staff and third-party applications. Canadian organizations may share the same cloud platforms, vendors and help-desk practices even when an announced victim is American.
The practical defence is not limited to changing customer passwords after a breach. Organizations should protect support agents with phishing-resistant authentication, require stronger verification for account recovery, restrict bulk data exports and alert on unusual downloads by legitimate accounts.
They should also know which vendor holds employee identity, health or access-control information. A company can secure its own network and still inherit exposure from a human-resources, education or customer-management provider.
The reported cooperation may produce further arrests, or it may reveal that the network is more fragmented than its public branding suggests. Until authorities announce charges and evidence, the responsible framing is narrow: an arrest is confirmed, the reported identity and assistance remain attributed, and the investigation is continuing.
Tags: ShinyHunters, cyber extortion, FBI investigation, Jordan