Reuters reported on 3 October that Saif al-Din Khader, described as a suspected ShinyHunters member, was detained in Jordan and that two of three people familiar with the matter described him as helping the FBI identify other hackers. Reuters could not verify the detention circumstances or location, and the FBI did not confirm this specific arrest.[1]
The Reuters account and its limits
Reuters described Khader as a suspected member of ShinyHunters and said three people familiar with the matter told the agency he had been detained by Jordanian authorities.[1] Two of those people said he was brought into custody on Tuesday and was helping the FBI and global law-enforcement agencies locate other hackers.[1]
The report also states that Reuters could not determine the circumstances of the detention or where Khader was being held.[1] The FBI declined to comment on any specific arrest or activity abroad, while saying it was investigating the incident and had worked with partners to arrest multiple subjects.[1] That wording leaves open whether the FBI’s general statement refers to Khader, to the separate Dutch case, or to other subjects.[1]
The difference between a source-backed report and a confirmation matters here. In Reuters’ account, both the Jordan detention and the cooperation claim remain attributed statements rather than findings from a court or a named Jordanian authority.[1]
Separate records, separate evidentiary weight
These records carry different evidentiary weight and should not be read as one proven chain of events.
| Date | Record | What it establishes | Boundary |
|---|---|---|---|
| 28 September (announcement) | FBI video | One alleged ShinyHunters leader was arrested by Dutch police under Dutch law.[3] | It does not identify Khader or place an arrest in Jordan.[3] |
| 29 September | Il Post | An internal FBI note was reported to say employee data had been taken in the previous week’s attack.[2] | The exact number and categories of data taken were not known.[2] |
| 30 September | Reuters report, published 3 October | The 3 October Reuters report said the ShinyHunters website had gone offline after a deadline directed at the FBI expired.[1] | Reuters could not determine why it went offline.[1] |
| 3 October | Reuters report | Three informed people were cited for the Jordan detention account; two described FBI cooperation.[1] | Detention circumstances and location were not verified, and the FBI did not confirm this specific arrest.[1] |
In a video published on 28 September, the FBI described a Dutch arrest and said the suspect was arrested under Dutch law.[3] AP reported that the Dutch police statement announcing that arrest did not mention the FBI hack or coordination with American law enforcement.[4] This official and independent record does not verify a Jordanian detention, identify Khader, or establish the cooperation claim.[3][4]
On 29 September, Il Post reported an internal FBI note saying employee data had been taken, while also noting that the exact amount and type of data were not known.[2] In its 3 October report, Reuters said the ShinyHunters site had gone offline after a Wednesday deadline directed at the FBI expired, but said it could not determine why.[1] On 3 October, Reuters published the Jordan account with the qualifiers that matter most: three people cited, two describing FBI cooperation, and no verification of detention circumstances or location.[1]
What the data report does and does not show
Il Post’s account was about the alleged breach, not Khader’s detention. It said the FBI had circulated an internal note about personal data taken in the preceding week’s attack and that the attack had been claimed by ShinyHunters.[2]
Il Post described personal information categories that can include names, dates of birth, addresses, telephone numbers, taxpayer IDs, family contacts and job-position details, but said there were no details on how much or which information was actually taken.[2] Reuters’ own sample analysis separately found personal, medical, psychiatric and sensitive job-role information in data shared by the group.[1] Neither account connects that sample analysis to Khader personally, and neither independently confirms a Jordanian detention or cooperation arrangement.[1][2]
That distinction also matters for legal language. A reported detention is not a conviction, and a claim that someone is cooperating does not establish that person’s role in the alleged breach.
The next record needed
An official Jordanian statement, court record or on-the-record FBI confirmation would materially change the evidentiary position. At the last check on 4 October 2026, the responsible description remained narrower: Reuters reported the claims, and the cited sources did not independently verify them.[1][2][3][4] That leaves the detention, its circumstances and any cooperation arrangement as open questions, separate from what is reported about the data exposure.[1][2]
Sources
[2] Il Post: FBI employee data reportedly stolen in ShinyHunters attack
