A suspected member of the ShinyHunters cybercrime group, Saif al-Din Khader, was reportedly detained in Jordan earlier this week and is now cooperating with the FBI. Khader, who has been identified by security journalist Brian Krebs as the alleged leader of ShinyHunters operating under the alias "Rey," is said to be assisting investigators in tracking down other members of the group.
Sources familiar with the matter indicate that Khader's detention occurred on Tuesday, October 2, 2026. He is reportedly providing investigators with access to his devices and digital communications, which could reveal crucial evidence and help identify former associates. The FBI has not commented on specific arrests or overseas activities but confirmed its ongoing aggressive investigation into the recent cyber incident allegedly involving ShinyHunters, stating that multiple subjects have already been arrested in collaboration with international partners.
This development follows a prior arrest in the Netherlands. Dutch police confirmed that a 24-year-old man from Amsterdam, identified by multiple sources including KrebsOnSecurity as Pepijn van der Stap, was arrested earlier in September as part of the ShinyHunters investigation. Van der Stap, known online as "Umbreon," appeared before the Rotterdam District Court on September 29. His connection to ShinyHunters stems from his use of the "Umbreon" alias and Pokémon imagery on BreachForums as early as 2021.
The "Umbreon" imagery also featured prominently in an ASCII art defacement left by ShinyHunters on the FBIjobs.gov website after a reported breach. This image is identical to one used in a 2020 HackForums defacement attributed to ShinyHunters, predating Van der Stap's "Umbreon" account. Some sources suggest that the use of this imagery in the FBI defacement might have been a deliberate attempt by "Rey" (Khader) to implicate Van der Stap, due to reported disagreements between them over control of the ShinyHunters brand and data.
The FBI Director, Kash Patel, had previously hinted at impending arrests, stating on X (formerly Twitter) on September 30, "NO SAFE HAVEN. Working with our Dutch National Police partners, the FBI helped put an alleged leader of ShinyHunters—a global cybercrime threat actor—behind bars. And we’re not done. FBI teams are working new leads RIGHT NOW. More arrests are on the table."
ShinyHunters' infrastructure experienced disruptions concurrently with Khader's reported detention. Reuters lost contact with the group's usual communication account on Tuesday, and by Wednesday, the group's dark web leak site was entirely offline. However, a new ShinyHunters leak site reportedly reappeared online on Thursday, suggesting the group remains active despite the recent arrests.
The group gained notoriety for claiming to have stolen personal data on every FBI employee. Earlier analysis of a leaked sample by Reuters indicated it contained detailed personal information, sensitive job-related data, and psychiatric and medical records. If these claims are substantiated, the incident could be comparable in scope to the 2015 OPM breach.
Interestingly, "Rey" (Khader) had reportedly informed Brian Krebs in November 2025 that he had been covertly cooperating with law enforcement since June of that year, well before any public announcements. An FBI Cyber Division official noted that arrests often increase an individual's willingness to cooperate, and seized servers can provide intelligence on other group members.
