By Jana Winter, Raphael Satter and AJ Vicens
WASHINGTON, Oct 3 (Reuters) – A key member of the ShinyHunters hacking group, which claims to have stolen data on every FBI employee, was detained this week in Jordan, three people familiar with the matter told Reuters. Two of the sources said he was cooperating with the FBI to identify his fellow hackers.
Saif al-Din Khader was detained by Jordanian authorities, the three sources said. Two of them said he was brought into custody on Tuesday. Reuters could not immediately determine the circumstances of Khader’s detention or his current whereabouts. Two sources said that he is helping the FBI and global law enforcement locate the other hackers in the group.
The FBI declined to comment on any specific arrest or activity abroad but said that the bureau “continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects — and we will spare no resource in bringing each of the responsible individuals to justice.”
Reuters’ attempts to reach Khader and members of his family over the past week and a half have been unsuccessful.
The detention of Khader — whose alleged hacker nickname is Rey — is the latest twist in the case of ShinyHunters. The prolific cyber extortion group, which has a long history of targeting major corporations around the world, is believed by experts to consist mainly of young, English-speaking hackers focused on data theft and extortion.
Their theft of what they claim are mountains of data on every single FBI employee has drawn comparisons to the allegedly Chinese-linked intrusion at the US Office of Personnel Management in 2015, which compromised sensitive details on millions of Americans who had been vetted for security clearances.
SENSITIVE INFORMATION
A Reuters analysis of a sample of the data shared by ShinyHunters revealed that the data contained extensive personally identifiable information of FBI employees, sensitive job role information, and psychiatric and medical information.
Khader’s cooperation with investigators could be critical to helping contain — or at least understand — the damage. One source said he was walking investigators through his electronic devices and digital correspondence to help the FBI locate his cohorts.
“His cooperation is critical to ongoing efforts to arrest these hackers,” the source told Reuters.
There have been hints for days that ShinyHunters was experiencing disruption following the announcement of its break-in at the FBI. Beginning on Tuesday, Reuters was unable to reach ShinyHunters through the online account it previously used to communicate with journalists. Then, on Wednesday, the group’s dark web site, where it had previously posted threats to the FBI, disappeared.
The bureau’s director, Kash Patel, has been hinting at more arrests following the announcement that another alleged ShinyHunters member, Pepijn van der Stap, had been detained in the Netherlands.
“FBI teams are working new leads RIGHT NOW,” Patel said on Wednesday in a message posted to X. “More arrests are on the table.”
(Reporting by Raphael Satter; Editing by Sanjeev Miglani)
Comments