Jordanian Arrest Ties ShinyHunters Leak to FBI Cooperation

Jordanian authorities have taken into custody Saif al-Din Khader, a figure alleged to be linked to the notorious hacking collective ShinyHunters, according to sources familiar with the investigation. Khader is reported to be working with the U.S. Federal Bureau of Investigation as the agency grapples with a large‑scale data breach that exposed thousands of employee records from multiple corporations.

ShinyHunters, a group that first gained notoriety in 2020 for posting stolen databases on underground forums, has been implicated in a string of high‑profile leaks over the past few years. Their modus operandi typically involves breaching corporate networks, extracting personal and payroll information, and then offering the data for sale to the highest bidder. The latest incident appears to follow that pattern, with the compromised files containing names, email addresses, salaries and other sensitive details of employees across several sectors.

The breach was discovered in early September when security teams at several affected firms noticed unusual activity on their internal systems and reported the findings to law enforcement. Subsequent forensic analysis confirmed that an unauthorized party had exfiltrated employee data from at least three separate databases. The FBI opened a joint investigation with international partners, focusing on identifying the actors behind the intrusion and assessing the scope of the exposure.

Jordanian police confirmed that Khader was detained on suspicion of facilitating the breach, though they have not publicly released the specific charges. The detention aligns with a broader effort by Middle Eastern law‑enforcement agencies to cooperate with Western authorities on cybercrime cases, particularly those involving transnational groups. Officials indicated that Khader’s cooperation could provide investigators with valuable insight into the group’s operational structure, communication channels, and potential future targets.

While the investigation remains ongoing, the cooperation agreement signals a willingness by both the FBI and Jordanian officials to pursue a coordinated response to the threat posed by organized hacking groups. Legal experts note that any plea or information sharing could lead to reduced sentencing for Khader, but also underscore the challenges of attributing cyberattacks across borders. The incident has reignited calls for stronger data‑protection standards and greater international collaboration to deter similar breaches in the future.