ShinyHunters member Saif al-Din Khader detained in Jordan, reportedly helping FBI
Reuters, citing three sources, reports that Saif al-Din Khader, a ShinyHunters member, was detained in Jordan this week and is helping the FBI find the group's other hackers. The FBI declined to comment on any specific arrest.
1 / 2
The story, neutrally told
Right · 2A key member of the ShinyHunters hacking group, which claims to have stolen data on every FBI employee, was detained in Jordan this week, three people familiar with the matter told Reuters. The Straits TimesRC “A key member of the ShinyHunters hacking group, which claims to have stolen data on every FBI employee, was detained this week in Jordan, three people familiar with the matter told Reuters.” Read at The Straits Times ↗ The Jerusalem PostRC “was detained in Jordan this week and is cooperating with the FBI, three people familiar with the matter told Reuters.” Read at The Jerusalem Post ↗ Right · 2The sources named him as Saif al-Din Khader, whose alleged hacker nickname is Rey. All three said Jordanian authorities detained him, and two said he was taken into custody on Tuesday. The Straits TimesRC “Saif al-Din Khader was detained by Jordanian authorities, the three sources said. Two of them said he was brought into custody on Tuesday.” Read at The Straits Times ↗ The Jerusalem PostRC “whose alleged hacker nickname is Rey” Read at The Jerusalem Post ↗ Right · 2Two sources said Khader is helping the FBI and global law enforcement locate the other hackers in the group. One source said he was walking investigators through his electronic devices and digital correspondence, and called his cooperation "critical to ongoing efforts to arrest these hackers". The Straits TimesRC “Two sources said that he is helping the FBI and global law enforcement locate the other hackers in the group.” Read at The Straits Times ↗ The Jerusalem PostRC “One source said he was walking investigators through his electronic devices and digital correspondence to help the FBI locate his cohorts.” Read at The Jerusalem Post ↗
Right · 2Reuters could not determine the circumstances of the detention or where Khader is being held, and its attempts to reach him and his family over the past week and a half were unsuccessful. The Jerusalem PostRC “Reuters could not immediately determine the circumstances of Khader's detention or where he is being held.” Read at The Jerusalem Post ↗ The Straits TimesRC “Reuters’ attempts to reach Khader and members of his family over the past week and a half have been unsuccessful.” Read at The Straits Times ↗ Right · 2The FBI declined to comment on any specific arrest or activity abroad. It said it "continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects". The Straits TimesRC “The FBI declined to comment on any specific arrest or activity abroad” Read at The Straits Times ↗ The Jerusalem PostRC “having already worked with partners to arrest multiple subjects” Read at The Jerusalem Post ↗ Right · 1Another alleged member, Pepijn van der Stap, was earlier reported detained in the Netherlands. FBI Director Kash Patel posted on X on Wednesday that "FBI teams are working new leads RIGHT NOW" and "More arrests are on the table." The Jerusalem PostRC ““FBI teams are working new leads RIGHT NOW,” Patel said on Wednesday in a message posted to X/Twitter. “More arrests are on the table.”” Read at The Jerusalem Post ↗
Right · 1The group appeared to be disrupted. Reuters could not reach it through its usual online account from Tuesday, and its dark web site went offline on Wednesday. Operators of a linked email address blamed sabotage by rivals and an "unrelated incident". In its latest email they said "we want no further escalation" with the FBI, which Reuters could read as "ShinyHunters backing down completely". The Jerusalem PostRC “Then, on Wednesday, the group's dark web site, where it had previously posted threats to the FBI, disappeared.”“The operators said Reuters could interpret their message as meaning, “ShinyHunters backing down completely.”” Read at The Jerusalem Post ↗ Right · 1The group said on September 22 that it had hacked the FBI in retaliation for an advisory accusing it of "exaggerated claims of access", and gave the bureau a week to withdraw the advisory. A Reuters analysis of a data sample found extensive personal information on FBI employees, job role details, and psychiatric and medical information. The Jerusalem PostRC “The group had previously struck a defiant note, saying on September 22 that it had hacked the FBI in retaliation over an advisory that accused ShinyHunters of making "exaggerated claims of access" to extort victims for money.”“A Reuters analysis of a sample of the data shared by ShinyHunters revealed that the data contained extensive personally identifiable information of FBI employees, sensitive job role information, and psychiatric and medical information.” Read at The Jerusalem Post ↗ Right · 1Khader's alleged ties to the group were already known. Journalist Brian Krebs reported last year that he was a key member of Scattered Lapsus$ Hunters, an umbrella group that included ShinyHunters, and quoted him as saying he had quit and was cooperating with law enforcement. ShinyHunters nonetheless kept hacking into 2026, claiming break-ins at Rockstar Games and Canvas. The Jerusalem PostRC “Last year, the independent journalist Brian Krebs reported that Khader was a key member of Scattered Lapsus$ Hunters, an umbrella group of hackers that included ShinyHunters.”“But ShinyHunters continued its hacking spree into 2026, claiming credit for break-ins at video game developer Rockstar Games” Read at The Jerusalem Post ↗
Right · 2Experts believe the group consists mainly of young, English-speaking hackers focused on data theft and extortion. The FBI theft has been compared to the allegedly Chinese-linked 2015 intrusion at the US Office of Personnel Management. Reuters has reported that law enforcement has struggled to prosecute related groups such as Lapsus$ and Scattered Spider. The Straits TimesRC “a motley crew believed by experts to consist mainly of young, English-speaking hackers focused on data theft and extortion.” Read at The Straits Times ↗ The Jerusalem PostRC “Law enforcement agencies around the world, including in the United States, have struggled to arrest and prosecute members of related groups such as Lapsus$ or Scattered Spider, Reuters has previously reported.” Read at The Jerusalem Post ↗
Every sentence links to the reporting it rests on. The pill in front of each says where its sources sit: Left, Centre or Right when one side supplies at least half of them, Mixed when they are evenly split. The number is how many outlets it cites.
Left0 outlets
No left outlet in our sources has covered this story yet.
Centre0 outlets
No centre outlet in our sources has covered this story yet.
Right2 outlets
- Framing
- Both outlets, The Straits Times and The Jerusalem Post, run Reuters copy that leads with the sourced report of the detention and Khader's cooperation with the FBI. The framing is an investigative breakthrough against a hacking group.
- Emphasis
- Anonymous-source reporting, the FBI's statement, the group's disruption and conciliatory tone, and Patel's hints of more arrests (the last three in the Jerusalem Post version).
- Leaves out or plays down
- The Straits Times version omits the group's disruption, Patel's remarks, the Krebs background and the data-sample analysis. Neither version has comment from Jordan or from Khader.
- Charged language
- “motley crew”“key member”
- For example
-
“Two of the sources said he was cooperating with the FBI to identify his fellow hackers.” — The Straits Times
“Khader's cooperation with investigators could be critical to helping contain - or at least understand - the damage.” — The Jerusalem Post
What every side reports
- Reuters, citing three sources, reports that Saif al-Din Khader was detained by Jordanian authorities this week.
- Two sources said he is helping the FBI locate the group's other hackers.
- The FBI declined to comment on any specific arrest.
FBI organisation
The FBI declined to comment on any specific arrest abroad. It says it is aggressively investigating and has already worked with partners to arrest multiple subjects.
“we will spare no resource in bringing each of the responsible individuals to justice.” — The Straits Times
ShinyHunters organisation
The group claims to have stolen data on every FBI employee. Operators of a linked email address told Reuters it wants no further escalation, and attributed its site going offline to rival sabotage and an unrelated incident.
““we want no further escalation” with the FBI” — The Jerusalem Post
Left0 articles
No coverage yet.
Centre0 articles
No coverage yet.
Right2 articles
-
The Straits TimesRC · · via Reuters
ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau, sources say
Neutral Reuters wire copy carried by The Straits Times; a short sourced report of the detention and cooperation, with the FBI's statement.
-
Key ShinyHunters hacker detained in Jordan after FBI breach, is cooperating, sources say
Neutral Fuller Reuters copy carried by The Jerusalem Post, adding the group's disruption, Patel's remarks, and Khader's history.
- 3 Oct 16:53 First The Straits TimesRC ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau, sources say via Reuters
- 3 Oct 18:24 +1h 31m The Jerusalem PostRC Key ShinyHunters hacker detained in Jordan after FBI breach, is cooperating, sources say
Times are when each article was published, or when we first saw it if the outlet gave no time.