An alleged ShinyHunters member was reportedly detained in Jordan and is said to be helping investigators identify other people behind the group’s breach campaign. Reuters reported that Saif al-Din Khader was arrested on September 28 and is cooperating with the FBI and other agencies; the report follows the recent arrest of another alleged ShinyHunters figure, Pepijn van der Stap, and comes after ShinyHunters claimed high-profile data thefts including an FBI-related breach exposing agent and task-force officer data.
Why it matters: ShinyHunters has been tied to repeated large-scale data theft and extortion affecting major companies and government personnel, so arrests and cooperation could disrupt an active threat actor and help victims understand attribution. Organizations hit by recent ShinyHunters activity should still treat the group as active, monitor for leaked data and follow-on phishing, and review user notifications and response plans.
BrianKrebs
2026.10.07
81% relevant
This report updates the same arrest/cooperation development by naming Boeing's divested Jeppesen ForeFlight unit as a victim being extorted when the suspect was detained, and by linking the arrest concretely to the broader ShinyHunters PeopleSoft breach spree.
2026.10.05
100% relevant
This article establishes a distinct law-enforcement milestone in the ShinyHunters case: the reported detention and cooperation of an alleged core member, rather than a specific victim breach already tracked.
← Back to all stories