FBI ShinyHunters Case: Multiple Arrests Confirmed in Latest Update

FBI confirms arrests linked to ShinyHunters cyber extortion group, with ongoing investigations into data breaches and international operations.

FBI Verifies Apprehension of Several Individuals in ShinyHunters Cybercrime Probe

The Federal Bureau of Investigation has verified the apprehension of several individuals in connection with its ongoing investigation into the ShinyHunters cyber extortion group. The confirmation follows reports of the detention of Saif al-Din Khader, a suspected member of the organization, in Jordan. Khader, who operates under the alias “Rey,” was reportedly taken into custody on September 29, according to sources cited by Reuters. He is said to be cooperating with U.S. and international law enforcement agencies to provide details about other individuals linked to the group. A spokesperson for the FBI stated that the bureau is actively pursuing the cyber incident attributed to ShinyHunters, emphasizing its commitment to holding all involved parties accountable. The agency has not disclosed the identities of the arrested individuals or confirmed whether Khader was among them.

International Law Enforcement Actions Expand

The detention of Khader coincides with earlier arrests in the Netherlands, where authorities detained a 24-year-old man identified as Pepijn van der Stap, known online as “Umbreon,” on September 15. The FBI has described van der Stap as an alleged leader of ShinyHunters, alleging that he and associates compromised over 140 organizations and extorted at least $70 million since 2025. While Dutch authorities have not officially named the individual, independent reports have linked him to the alias Umbreon. ShinyHunters has refuted any association with van der Stap. The FBI has acknowledged the Dutch arrest but has not publicly identified the suspect or specified which cases are included in its reference to “multiple” arrests.

Investigation into FBIJobs.gov Breach

The arrests occur as the FBI continues to probe a September breach of its job portal, FBIJobs.gov, which ShinyHunters claimed involved the theft of sensitive data related to current, former, and prospective FBI employees. The group later characterized the incident as a publicity stunt rather than a financial motive. Despite the law enforcement actions, ShinyHunters’ data leak website remains operational, retaining existing victim listings. The continued presence of the site suggests that the group’s infrastructure has not been dismantled, though it is unclear who maintains control or whether the absence of new claims correlates with the ongoing investigation.

Law Enforcement Warns of Further Actions

FBI Cyber Division Assistant Director Brett Leatherman has warned that arrests and seized assets could expose additional members of ShinyHunters. FBI Director Kash Patel has also indicated that investigators are pursuing new leads, with “more arrests expected.” However, the bureau has provided limited details about the individuals it claims have been apprehended, leaving Khader’s role and the total number of arrests ambiguous. ShinyHunters’ data leak site remains active, with no indication of its removal despite recent law enforcement efforts. The group’s continued online presence underscores the challenges faced by authorities in disrupting its operations. Meanwhile, the FBI and international partners remain focused on identifying and prosecuting all individuals involved in the cyber extortion network.

About Author

Anuj

See author's posts