Jordanian authorities detained Saif al-Din Khader, a suspected ShinyHunters member, and U.S. officials say he is cooperating with investigators. The FBI says it is aggressively investigating the alleged cyber incident and has worked with partners to arrest multiple subjects. ShinyHunters claimed it defaced the FBI website and stole data connected to FBI workers, but those claims have not been publicly verified. A separate 24-year-old suspect from Amsterdam was arrested in the Netherlands on Sept. 15; sources identified him as Pepijn van der Stap, while the group denies he is connected. The number of other alleged participants, the evidence against the suspects, and the details of Khader’s cooperation remain unclear.
TLDR: A suspected ShinyHunters member has been detained in Jordan, and U.S. officials say he is cooperating with investigators. The FBI says its inquiry continues with international partners, while the breach claims and suspects’ alleged roles have not been publicly established.
Jordanian authorities have detained Saif al-Din Khader, a suspected member of the hacking group ShinyHunters, according to two U.S. officials and another source familiar with the matter. Those sources also say Khader is cooperating with investigators. The reported detention is a new development in an investigation involving alleged cybercrime and law-enforcement partners in more than one country.
The official rationale in the available account is clear: the FBI says it is investigating the recent cyber incident allegedly involving ShinyHunters and seeking to bring those responsible to justice. The Bureau says it has worked with partners to arrest multiple subjects and will spare no resource in the investigation. That is the stated purpose of the work; the excerpt does not describe a new policy or a broader government rule.
The FBI declined to comment on Khader’s arrest specifically. Its public statement described an ongoing investigation, not a final finding about Khader or any other individual. The distinction matters. A detention and reported cooperation are investigative developments, while responsibility for the alleged incident remains a matter for the authorities to establish.
ShinyHunters claimed last month that it defaced the FBI website. The group also asserted that it had obtained data related to every FBI employee, a claim that has not been publicly verified. In communications posted on the dark web and exchanges with media outlets, the group claimed it stole between two and three terabytes of data related to FBI workers. The claim is not confirmation that the data was taken or that it included the records the group described.
The hackers said they used a new vulnerability in Oracle PeopleSoft, a human-resources management program. The account does not independently confirm that explanation. It also does not establish how many people may have been involved. A U.S. source told CBS News that the number of other alleged hackers remains unclear.
The Jordan detention follows a separate arrest in the Netherlands. Dutch National Police and the FBI previously reported that a 24-year-old from Amsterdam was arrested on Sept. 15 on suspicion of being a ShinyHunters member. Dutch police did not publicly name the suspect. Sources familiar with the case identified him to CBS News as Pepijn van der Stap.
That arrest came before ShinyHunters announced that it had hacked the FBI jobs website. The announcement was first reported on Sept. 22 by 404 Media. The timing places the Dutch suspect in custody days before the group’s public claim, but it does not by itself establish whether he was involved in the alleged website breach. ShinyHunters has said van der Stap had “no association” with the group and criticized Dutch police. That denial is the group’s statement, not an independent determination of the allegation.
The reported cooperation by Khader may give investigators information, but the available account does not say what he has shared or whether his cooperation has been verified publicly. It also does not describe the legal steps that led to his detention in Jordan, any possible transfer, or the formal status of a case there. Those cross-border details remain unknown in the material available for this report. The account identifies Jordanian authorities as the detaining agency and U.S. officials as sources for the report; it does not provide a public statement from Jordanian authorities.
The practical impact described so far is limited to arrests and an active investigation. The FBI says it has worked with partners to arrest multiple subjects, and the Dutch arrest was reported on Sept. 15. No fees, new forms, compliance deadlines, or new enforcement rules are described. No specific requirement for FBI employees or other members of the public is identified. The reported breach claims concern FBI workers, but the group’s claims about the volume and scope of data have not been publicly verified.
The case also leaves important questions open. The number of other alleged participants is unclear, and the account does not establish whether the claimed PeopleSoft vulnerability was used as described. It does not state what evidence links either detained suspect to the website incident. These gaps are part of the reported status of the investigation, not grounds to treat allegations as proven.
The FBI says its investigation continues and that it is working with partners. The reported detention in Jordan and the earlier arrest in the Netherlands show that the inquiry has an international dimension, while the available details remain incomplete. Further statements or investigative steps may clarify the allegations, Khader’s reported cooperation, and the number of people involved. Any such steps are necessary to establish the facts and determine responsibility under the applicable process.
Miles Harrington serves as the Senior Correspondent for Federal Systems & Executive Power at Just Right News, where he brings a disciplined, constitutionalist lens to the inner workings of the American government. With a focus on the mechanics of the federal bureaucracy and the limits of executive authority, Harrington has established himself as a vital voice for readers who value transparency, accountability, and the preservation of the separation of powers.
A native of Richmond, Virginia, Harrington’s perspective is deeply rooted in the traditions of the Old Dominion. Growing up in a city defined by its historical significance and its role as a center of American jurisprudence, he developed an early appreciation for the foundational principles of the Republic. His upbringing in Richmond—a place where the legacy of the Founding Fathers is woven into the landscape—instilled in him a belief that the federal government should remain within its constitutional bounds. This background informs his skepticism of centralized overreach and his commitment to reporting on the ways in which the administrative state impacts the lives of everyday citizens.
In his current role, Harrington specializes in the complexities of federal systems. He doesn’t just report on the headlines of the day; he digs into the structural shifts within the executive branch that often go unnoticed by the mainstream press. Whether he is analyzing the implications of a new federal regulation or investigating the expansion of agency jurisdiction, his work is characterized by a rigorous adherence to the facts and a dedication to the rule of law.
Harrington is perhaps best known for his signature feature series, “How Washington Works.” Through this ongoing project, he demystifies the often-opaque processes of the nation’s capital, pulling back the curtain on the “Deep State” and the unelected officials who wield significant influence over national policy. By breaking down complex legislative maneuvers and executive orders, he empowers Just Right News readers to understand the true levers of power in Washington. His reporting serves as a necessary check on the federal government, ensuring that the actions of those in power are held up to the light of public scrutiny.
Now based in Washington, D.C., Harrington operates at the epicenter of the political world, yet he remains intentionally distanced from the “Beltway bubble.” His proximity to the halls of power allows him to maintain a robust network of sources across the federal landscape, but his heart remains in the principled conservatism of his Virginia roots. He views his role not merely as a reporter, but as a steward of the public trust, dedicated to providing the clarity and context that conservative voters need to navigate an increasingly complex political environment.
Through his sharp analysis and unwavering commitment to the truth, Miles Harrington continues to be a cornerstone of the Just Right News team. His work ensures that the principles of limited government and executive restraint remain at the forefront of the national conversation, providing a crucial service to those who believe in a government that is truly of, by, and for the people.