ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau, sources say

By Jana Winter, Raphael Satter and AJ Vicens

WASHINGTON, Oct 3 (Reuters) - A key member of the ShinyHunters hacking group, which claims to have stolen data on every FBI employee, was detained this week in Jordan, three people familiar with the matter told Reuters. Two of the sources said he was cooperating with the FBI to identify his fellow hackers.

Saif al-Din Khader was detained by Jordanian authorities, the three sources said. Two of them said he was brought into custody on Tuesday. Reuters could not immediately determine the circumstances of Khader’s detention or his current whereabouts. Two sources said that he is helping the FBI and global law enforcement locate the other hackers in the group.

The FBI declined to comment on any specific arrest or activity abroad but said that the bureau "continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects — and we will spare no resource in bringing each of the responsible individuals to justice."

Reuters’ attempts to reach Khader and members of his family over the past week and a half have been unsuccessful.

The detention of Khader — whose alleged hacker nickname is Rey — is the latest twist in the case of ShinyHunters, a motley crew believed by experts to consist mainly of young, English-speaking hackers focused on data theft and extortion.

Their theft of what they claim are mountains of data on every single FBI employee has drawn comparisons to the allegedly Chinese-linked intrusion at the US Office of Personnel Management in 2015, which compromised sensitive details on millions of Americans who had been vetted for security clearances.