Saif al-Din Khader, known in hacking circles as “Rey,” is in Jordanian custody after being detained on Tuesday, according to three people familiar with the matter. This move marks a significant breakthrough in the investigation into ShinyHunters, the cyber extortion group that claims responsibility for leaking sensitive data on the entire FBI workforce. While Jordanian officials have not publicly disclosed the exact circumstances of his arrest or his current holding location, two sources confirmed he is actively cooperating with law enforcement.
The FBI declined to confirm specific arrests abroad but issued a firm statement asserting the bureau “continues to aggressively probe the recent cyber incident.” The agency emphasized that it has already worked with partners to arrest multiple subjects and vowed to “spare no resource in bringing each of the responsible individuals to justice.” This official stance aligns with the intelligence that Khader is helping pinpoint the other hackers involved in the breach.
ShinyHunters is not a new threat to global security. Experts describe the collective as a network of primarily young, English-speaking hackers who specialize in high-profile data theft and extortion. Their target list has long included major corporations, making the alleged compromise of federal employee data a particularly severe escalation. The group’s operational style relies on speed and anonymity, making the detention of a core member like Khader a rare and valuable intelligence opportunity.
Attempts to reach Khader or his family members over the past ten days have yielded no response. His silence contrasts sharply with the public pressure applied by the US government. As the investigation expands, the focus shifts to how much data was actually exfiltrated and whether any of it has already been monetized in dark web markets.
The next major development will hinge on whether Khader’s cooperation leads to the identification of the group’s financial backers or technical leaders. Law enforcement agencies are expected to use the information he provides to coordinate further arrests across multiple jurisdictions in the coming weeks.