Saif al-Din Khader, believed to be a teenager, was reportedly detained in Jordan on suspicion of involvement with the hacking collective ShinyHunters, which claims to have exfiltrated more than 2TB of FBI employee data from the agency's jobs portal. The FBI says it is aggressively investigating the incident but has not publicly confirmed this particular arrest. Sources say Khader is cooperating with international law enforcement as authorities work to identify other suspects. Security experts characterize ShinyHunters as a resilient criminal brand that has targeted multiple sectors, and Dutch police recently detained another alleged member in Amsterdam.
Teenager Allegedly Linked to ShinyHunters Arrested in Jordan After Reported FBI Data Breach
(AFP/Getty)
Saif al-Din Khader, believed to be a teenager, was reportedly arrested in Jordan on suspicion of playing a leading role in the hacking collective ShinyHunters, according to Reuters. Authorities say the arrest relates to an alleged breach of the Federal Bureau of Investigation's (FBI) jobs portal.
ShinyHunters has claimed it exfiltrated more than 2 terabytes of FBI employee data. The group says the stolen material included personal information such as phone numbers, home addresses and medical details for bureau staff — claims that have been reported but remain subject to official verification.
The FBI has not publicly confirmed the Jordan arrest. In a statement about the broader incident the Bureau said it "continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects — and we will spare no resource in bringing each of the responsible individuals to justice."
FBI Director Kash Patel participates in a press conference in Washington, DC, on 1 July, 2026 (Reuters)
Sources cited by Reuters say Khader is cooperating with U.S. and international law enforcement to help identify other alleged members of ShinyHunters. The agency-level investigation continues while authorities attempt to verify the scope of the intrusion and the data allegedly taken.
"ShinyHunters has repeatedly demonstrated that it is more than a fixed set of people or infrastructure. It is a resilient criminal brand that has survived takedowns, arrests, and forum seizures by evolving its methods and attracting new operators,"
— Etay Maor, Vice President of Threat Intelligence, Cato Networks
Security researchers note the group has targeted organisations across sectors, including healthcare, financial services and law enforcement. Jade Brown, a researcher at cybersecurity firm Bitdefender, described ShinyHunters as a "no-holds-barred criminal enterprise" in a recent threat report.
Separately, Dutch police last week announced the arrest of another suspected ShinyHunters member in Amsterdam — a 24-year-old who is also accused of attempted incitement to commit two murders. "The ShinyHunters group is responsible for a large number of national and international victims," said Stan Duijf, who leads Dutch cybercrime investigations. "It is good that we have been able to arrest a suspect in the investigation into this group."
Investigations remain active and many details, including the full extent of any data exposure and formal charges in the Jordan arrest, have not been publicly confirmed. News agencies and law enforcement continue to monitor and report developments.
Help us improve.
