548/69 Tuesday, October 6, 2026
A man suspected of being a member of the ShinyHunters group has reportedly been detained by Jordanian authorities and is cooperating with the FBI to help identify other members of the group. The individual has been identified as Saif al-Din Khader, who sources said was arrested last Tuesday. However, details regarding the location of his detention and the circumstances surrounding the arrest have not been independently confirmed. The FBI declined to comment on the specific arrest but stated that it continues to investigate recent cyber incidents allegedly linked to ShinyHunters and is working with international partners, resulting in the arrests of several individuals connected to the investigation.
Sources stated that Khader is assisting the FBI and international law enforcement agencies in tracking remaining members of the group. He reportedly provided access to his devices and digital communications to help investigators identify former associates. The case is significant because ShinyHunters has claimed to have stolen personal information belonging to all FBI employees. Previous Reuters reporting indicated that samples of the leaked data contained personal details, information about sensitive job responsibilities, and psychiatric and medical information. Some observers have compared the potential severity of the incident to the 2015 U.S. Office of Personnel Management (OPM) breach, which exposed security clearance background investigation data belonging to a large number of Americans.
Around the same time, Dutch police confirmed the arrest of a 24-year-old man from Amsterdam in connection with the ShinyHunters investigation. Multiple sources identified him as Pepijn van der Stap, also known online as “Umbreon.” Reports linked him to ShinyHunters based on the use of the Umbreon name and character imagery in online activity, including the defacement of the FBIjobs.gov website. However, some sources suggested that the attribution could also reflect attempts by members of the group to shift blame onto one another. Following reports of Khader’s detention, ShinyHunters’ communication channels and dark web leak site showed unusual activity and were temporarily unavailable at times. A new version of the group’s website was later reported to have come back online, suggesting that the group may remain active despite the loss of some members or associates.