ShinyHunters Suspect Detained in Jordan Helps FBI Track Down the Group

A suspected ShinyHunters member arrested in Jordan is reportedly cooperating with the FBI, helping investigators track down the group.

A suspected member of ShinyHunters, the group that claims to have stolen data on every FBI employee, was picked up in Jordan this week.

The man is Saif al-Din Khader, detained by Jordanian authorities, with two sources placing the arrest on Tuesday. Reuters couldn’t confirm the exact circumstances or where he’s being held.

“A suspected member of the ShinyHunters hacking group, which ​says it stole data on every FBI employee, was detained in Jordan this week and is cooperating with the FBI, three people familiar with the matter told Reuters.” the Reuters states.

Two sources said he’s now helping the FBI and international law enforcement track down the rest of the group.

One source told Reuters that Khader is showing investigators his own devices and digital communications to help identify former associates. That gives investigators real access to potential evidence, not just a general promise to cooperate.

“The FBI declined to comment on any specific arrest or activity abroad but said that the bureau “continues to aggressively investigate ​the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects — and we will spare no resource in bringing each of the responsible individuals to justice.”” Reuters continues.

The case matters beyond Khader’s arrest. ShinyHunters claims to have stolen personal data on FBI employees, and Reuters’ earlier analysis found that the leaked sample included detailed personal information, sensitive job-related data, and psychiatric and medical records. Some have compared the incident to the 2015 OPM breach, in which a China-linked attack exposed security clearance data belonging to millions of Americans. If the ShinyHunters claims are even partly confirmed, that comparison would be justified.

Dutch police confirmed this week that the 24-year-old man from Amsterdam was arrested earlier this month as part of an investigation into the cybercrime group ShinyHunters. The suspect appears before Rotterdam District Court today, September 29. Multiple sources, including KrebsOnSecurity, have identified him as Pepijn van der Stap, a Dutch hacker previously known online as “Umbreon.”

The connection to ShinyHunters runs through the “Umbreon” alias. Van der Stap used that handle and Pokémon imagery on BreachForums as early as 2021.

Then the FBI jobs site defacement that ShinyHunters left after the FBIjobs.gov breach prominently featured an ASCII art version of the same Pokémon character, and the image appears identical to one used in a 2020 HackForums defacement attributed to ShinyHunters, a year before Van der Stap created his Umbreon account. That last detail cuts both ways: either the alias predates him in this context, or the timing coincidence is genuinely awkward. KrebsOnSecurity adds a more pointed interpretation: sources familiar with the investigation say the Umbreon imagery in the FBI defacement may have been a deliberate attempt by ShinyHunters’ current leader, a teenager from Amman, Jordan known as Rey, to pin the hack on Van der Stap. The two reportedly had ongoing bad blood over control of the ShinyHunters brand and data.

FBI Director Kash Patel had already hinted that more arrests were coming.

“FBI teams are working new leads RIGHT NOW. More arrests are on the table.” Patel wrote on X.

ShinyHunters’ own infrastructure has been wobbling since this week started. Reuters lost contact with the group’s usual communication account on Tuesday, the same day Khader was reportedly detained, and by Wednesday the group’s dark web leak site had gone offline entirely. The alleged leader of the group, Rey, told journalist Brian Krebs in November 2025 that he’d been quietly cooperating with law enforcement since June, well before any of this became public.

In November 2025, security journalist Brian Krebs reported that Rey was Saif Al-Din Khader after analyzing information obtained from infostealer logs and speaking directly with Khader over Signal.

What is new is what cooperation can look like when someone is in custody. An FBI Cyber Division official explained the situation last week: arrests can make people more willing to talk, while seized servers can reveal information about those who are still outside. Once someone’s laptop becomes evidence, loyalty can disappear very quickly.

A new ShinyHunters leak site reportedly came back online on Thursday, so the group itself isn’t dead, just missing one more member.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ShinyHunters )