Saif al-Din Khader, who goes by the online alias “Rey” and is linked to the ShinyHunters, is being held in Jordan, three sources told Reuters. Two of them said he was helping the FBI track down other members, but US authorities have not publicly confirmed his detention or his role.
Reuters reports that Jordanian authorities detained Khader on September 29. The agency notes, however, that it was unable to verify the conditions of his detention or his whereabouts, and efforts to contact him and his family were unsuccessful. Reuters presents the information as an exclusive report with sources familiar with the case.
The development concerns the investigation into the alleged cyberattack carried out by the ShinyHunters group against the FBI. It does not, by itself, prove Khader's involvement in the breach or the extent of the data the group claims was stolen.
What we know about the ShinyHunters team
Two of the three sources cited by Reuters said Khader was working with the FBI and law enforcement agencies in several countries to track down other individuals believed to be members of the ShinyHunters group. One of the sources said he was providing investigators with access to his devices and digital communications. Reuters did not disclose what information he had already provided.
Reuters attributes the alias “Rey” to Khader, while his connection to the ShinyHunters group is presented as alleged. The information about cooperation with authorities is based on two sources and not a public statement from the FBI or Jordanian authorities. The ShinyHunters group did not respond to BleepingComputer about the new report.
The reported detention in Jordan follows the arrest of a 24-year-old in the Netherlands, as part of an investigation into the ShinyHunters group, as previously reported by SecNews. This is a different person; the previous arrest does not confirm today's report or clarify Khader's legal status.
See also: Dutch police arrest hackers in ShinyHunters investigation
The FBI data claim remains under investigation
The ShinyHunters group has claimed to have accessed FBI systems and stolen a large amount of employee and candidate files. BleepingComputer reports that the group has talked about two to three terabytes of data, but notes that it has not independently verified the exploit, the movement between systems, or the total volume of files.
The FBI has said it is aware of the allegations of unauthorized activity affecting FBIJobs.gov and is investigating them. The agency has not publicly confirmed that data was stolen or that Khader has been arrested or is cooperating with it. The statement reported by Reuters refers generally to the investigation into the incident and the agency’s ongoing cooperation with partners in making arrests.
The distinction is important because the public picture of the case includes both news reports and claims by the ShinyHunters group. Khader's alleged cooperation may help authorities link digital identities to physical individuals, but it has not yet been made public what exactly he knows or whether he confirms the group's version.
Unanswered questions about the research
The official reason for the detention, the status under which Khader is being held and whether charges have been filed remain unknown. It was also not clear which agency in Jordan is responsible for the case or whether extradition proceedings will be initiated. Reuters notes that it was unable to verify these details.
On September 29, the FBI had called for members of the ShinyHunters group to surrender after a previous arrest, while the agency continued to search for those involved, according to a previous report by SecNews. The new report on Khader adds a potential clue to the international investigation, but does not close the gaps surrounding the alleged breach or the extent of the leak.
Until there is official confirmation, the detention and alleged collaboration should be treated as information attributed to Reuters sources. The case remains open and the claims about the FBI data still require independent verification.
See also: FBI calls on ShinyHunters members to surrender after arrest
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: ShinyHunters: Claims FBI breach via Oracle PeopleSoft zero-day
