FBI Detains Alleged ShinyHunters Member in Jordan
The FBI has detained a second individual connected to its investigation into a recent data breach involving law enforcement information, according to multiple FBI sources who spoke with Reuters. Saif al-Din Khader was arrested in Jordan on September 28 and is now cooperating with the FBI and other law enforcement agencies to help locate additional members of the ShinyHunters cybercriminal group.
The FBI declined to comment directly on Khader’s arrest but told Recorded Future News that it "continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters" and emphasized its commitment to bringing all responsible individuals to justice by working with partners and sparing no resources.
Background on Khader and Connection to ShinyHunters
Khader was first identified in November by cybersecurity journalist Brian Krebs as a key figure within ShinyHunters. Krebs traced the username "Rey" and several hacker profiles back to Khader, revealing he was a 16-year-old living in Amman, Jordan. After contacting Khader’s father, Krebs received a direct message from the teenager, who claimed he had already been in contact with European law enforcement agencies.
According to reports, Khader was responsible for dozens of significant cyber incidents targeting both European and American companies prior to his detention.
Context: Recent Arrests and ShinyHunters Activity
Khader’s arrest follows the detention of another alleged ShinyHunters member, Pepijn van der Stap, who was arrested by the FBI and Dutch National Police on September 29. Van der Stap, a well-known cybercriminal released earlier this year after serving time for a prior hacking conviction, was described by Krebs as a key figure in ShinyHunters and allegedly involved in a power struggle with Khader for control of the group.
The ShinyHunters leak site was taken down last week, reportedly by law enforcement agencies, but the group resurfaced on Telegram on Monday, claiming it was restarting a long-defunct cybercriminal forum to replace its leak site.
Impact of the FBI Data Breach
ShinyHunters has claimed responsibility for dozens of high-profile data thefts in recent months and has been under FBI scrutiny for nearly a year due to attacks on major organizations including Ticketmaster, AT&T, McGraw Hill, Carnival Cruise Line, and 7-Eleven. The group even targeted another Russian cybercriminal operation before launching its attack on the FBI.
The FBI breach exposed highly sensitive personal information, including the names, home addresses, cell phone numbers, Social Security numbers, FBI email addresses, and employee ID numbers of nearly every FBI agent. It also compromised thousands of records belonging to local police officers who collaborate with the FBI on task forces.
In response, the bureau issued an internal memo last week warning employees about the breach and the potential danger to them and their families.
ShinyHunters’ Statement on the Feud with the FBI
ShinyHunters communicated with several news outlets, stating it would not release the stolen information and did not wish to escalate its feud with the FBI. The group said the conflict began after disagreeing with an FBI advisory about its actions.
Source: The Record