Suspected ShinyHunters Hacker Detained in Jordan, Sources Say
Wertynews.com – A suspected ShinyHunters hacker detained in Jordan is cooperating with the FBI investigation, according to two U.S. officials and another person familiar with the matter. Jordanian authorities detained Saif al-Din Khader, whom U.S. officials identify as a suspected participant in the cybercrime group.
The detention is the latest development in an international investigation into ShinyHunters, which recently claimed it compromised an FBI-related employment website and obtained personnel data. The FBI has not publicly commented on Khader’s detention.
The bureau said its investigation into the alleged cyber incident remains active and includes cooperation with international law-enforcement partners.
“The Bureau continues to aggressively investigate the recent Cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects and we will spare no resource in bringing each of the responsible individuals to justice.”
Unverified Claims About FBI Employee Data
Last month, ShinyHunters said through dark-web communications and contacts with media outlets that it had obtained between 2 and 3 terabytes of information tied to FBI employees. The group also claimed it had data on every FBI worker, but those assertions have not been publicly verified.
The alleged hackers said they exploited a newly discovered Oracle PeopleSoft vulnerability. PeopleSoft is widely used for human-resources administration, but the available information does not establish the scope of any potential breach, the specific systems involved, or the accuracy of the group’s claims.
Cybercrime groups may publicize alleged thefts to pressure victims, generate attention, or increase the perceived value of data they say they possess. Investigators must determine whether information was actually accessed, what records may have been exposed, and whether any samples or descriptions released by the group are authentic.
The FBI jobs website incident became public on Sept. 22. It attracted heightened scrutiny because it involved a federal law-enforcement agency and because ShinyHunters has been associated with other high-profile data-breach claims.
Jordan Detention Follows Netherlands Arrest
The suspected ShinyHunters hacker detained in Jordan was taken into custody after another alleged member was arrested in the Netherlands. Dutch National Police and the FBI previously said a 24-year-old Amsterdam man was arrested on Sept. 15 on suspicion of belonging to the group.
That arrest came days before the group publicly claimed it had breached the FBI employment site. Dutch authorities did not release the suspect’s name, although people familiar with the matter identified him as Pepijn van der Stap.
ShinyHunters denied that Van der Stap was connected to the group, saying he had “no association” with it and criticizing Dutch police.
The sequence of events leaves key questions unanswered, including how many people may be involved in the alleged activity, what roles they may have played, and whether additional suspects remain under investigation.
Why International Cooperation Matters
Cybercrime investigations often involve several countries. Suspected operators may be located in one jurisdiction, targeted systems in another, and digital evidence spread across online services in multiple locations. Cooperation among agencies can be essential for gathering evidence and identifying those responsible.
Detention or arrest does not establish guilt. Investigators generally review digital records, communications, payment activity, technical infrastructure, and evidence connecting possible participants to specific actions. A hacking group’s public statement may be relevant, but it does not independently prove that every claim is true.
The case also highlights the security concerns surrounding human-resources software. These platforms may contain sensitive employee information, including work contact details, employment records, and other administrative data. Organizations facing newly identified software vulnerabilities typically review vendor guidance, apply available updates, and assess whether their systems show signs of unauthorized access.
FAQ: Suspected ShinyHunters Hacker Detained in Jordan
Who was detained in Jordan?
Jordanian authorities detained Saif al-Din Khader, whom U.S. officials identify as a suspected participant in ShinyHunters.
Is the suspect cooperating with the FBI?
Two U.S. officials and another person familiar with the case said Khader is cooperating with investigators.
Was FBI employee data confirmed stolen?
No public confirmation has established that the group obtained the amount or type of FBI employee data it claimed to possess.
What software vulnerability did the group claim to exploit?
The group said it used a newly discovered vulnerability in Oracle PeopleSoft, though the precise systems involved and the scope of any compromise have not been publicly established.