Press play to start listening
The FBI has confirmed that multiple suspects have been arrested during its investigation into a September cyber incident allegedly involving the ShinyHunters extortion group. The confirmation came days after Hackread.com reported the detention in Jordan of suspected member Saif al-Din Khader, known online as “Rey.”
Khader was detained on September 29, according to people familiar with the case cited by Reuters. He is reportedly cooperating with the FBI and other authorities as investigators seek information about others associated with the group.
“The bureau continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects, and we will spare no resource in bringing each of the responsible individuals to justice,” an FBI spokesperson told The Register in an email on Monday.
The FBI declined to identify the arrested suspects or confirm whether Khader was among them.
International Investigation Expands
Khader’s reported detention came two weeks after Dutch authorities arrested a 24-year-old man, Pepijn van der Stap, also known as Umbreon, in Amsterdam on September 15. The FBI described him as an alleged ShinyHunters leader and alleged that he and his co-conspirators had compromised more than 140 organizations and obtained at least $70 million in extortion payments since 2025.
Dutch authorities have not publicly named the man, but independent reporting has identified him as Pepijn van der Stap, also known as “Umbreon.” ShinyHunters has denied that van der Stap was associated with the group.
The FBI has separately acknowledged the Dutch arrest but has not publicly named that suspect. It has also not said which cases were included in its reference to “multiple” arrests or whether Khader was among them.
The arrests come amid the bureau’s investigation into the September compromise of FBIJobs.gov, which ShinyHunters claimed involved the theft of sensitive information belonging to current, former and prospective FBI personnel. The group later described the operation as a publicity campaign rather than an attempt to make money.
ShinyHunters Leak Site Remains Online
At the time of writing, ShinyHunters’ data leak site remained online, with its existing victim listings and download links still accessible. However, no additional breach claims had appeared following two entries published on October 1, both of which were later removed. The latest deletion was observed on October 3.
The continued availability of the site shows that the group’s public infrastructure was not taken offline after Khader’s reported detention. It does not reveal who retained access to the site or whether the lack of new claims is connected to the law enforcement investigation.
FBI Warns Other Members Could Be Identified
Brett Leatherman, assistant director of the FBI’s Cyber Division, previously warned that arrests and seized infrastructure could reveal who remains involved with ShinyHunters. FBI Director Kash Patel has also said investigators are pursuing new leads and that “more arrests are on the table.”
For now, the FBI has released few details about the suspects it says have been arrested, leaving Khader’s reported role in the investigation and the number of additional people detained unclear.
(Photo by Kindel Media – Pexels)
