When the Federal Bureau of Investigation discovered its own recruitment website had been compromised, the world understood something had gone badly wrong. Behind the attack stood a 16-year-old from Amman who called himself "King", Saif al-Din Khadr, whose story demonstrates how a single keyboard can inflict enormous damage.
The Teenage "King" Falls
Teen Who Hacked FBI Arrested in Amman
Saif al-Din Khadr, 16, known as "Rey," penetrated FBI recruitment site and stole terabytes of data before dramatic arrest in Jordanm now cooperating fully with investigators hunting his network
The Young King from Amman
Khadr chose the alias "Rey" (Spanish for king) and established himself as a prominent operator in the "Scattered LAPSUS$ Hunters" collective, which merged three hacking groups: ShinyHunters, Scattered Spider, and LAPSUS$. The group specialized in social engineering and breaches of technology organizations.
The victim list included Jaguar Land Rover, Rockstar Games, and American education systems. In November 2025, cybersecurity researcher Brian Krebs identified his tracks, and Khadr claimed in an encrypted conversation that he had "retired" from the criminal world since June 2025.
The FBI Breach
In September 2026, ShinyHunters members announced they had penetrated the FBI's official recruitment site (FBIJobs.gov) and obtained 2-3 terabytes of information. They sent journalists a list of approximately 5,000 employee names with sensitive details and replaced the agency's logo. The breach served as both a "marketing campaign" and a protest against an FBI warning issued against them.
The Fall in Amman: The Handcuffs Close
On or around September 29, 2026, Saif al-Din Khadr's digital kingdom came to an end. Jordanian authorities raided his hideout in Amman and arrested the teenage prodigy who had shaken the global cyber world.
The first dramatic report leaked through foreign sources at Reuters news agency. Three sources close to the matter confirmed that Khadr was not only arrested but immediately began a sharp reversal and full, unrestricted cooperation with FBI investigators and other international law enforcement bodies.
According to those sources, the Jordanian teen's turnaround was swift and absolute. Khadr granted American agents complete and free access to all his encrypted devices, his personal accounts, and all his past correspondence. One source involved in the investigation described his cooperation as "critical" and of enormous value in the broader effort to identify, locate, and arrest additional members of the distributed crime network.
Shortly afterward, Jordan itself officially confirmed the arrest—though without specifically naming the teen—and emphasized that the sprawling investigation is still ongoing. "Rey's" fall in Amman did not occur in a vacuum. It came just two weeks after another devastating blow to the group: the arrest in the Netherlands of another central suspect in the collective's leadershipm Pepijn van der Staaf, known by his underground alias "Umbreon."
Decades of War: The FBI vs. the Hackers
The dramatic arrest of a 16-year-old in the heart of Amman is not an isolated incident occurring in a vacuum. It represents another tense chapter in a long, complex, and turbulent war waged for more than three decades between the Federal Bureau of Investigation in the United States and the global hacking world.
In the past decade, the FBI has been forced to contend with a new and complex reality: a wave of young groups, English-speaking, basing their breaches primarily on social engineering and human manipulation. This list prominently featured the LAPSUS$ group, the Scattered Spider collective, and now ShinyHunters as well. Unlike in the past, these groups do not operate from hostile and isolated strongholds like Russia or China, but emerge from relatively friendly and democratic countries, Britain, the Netherlands, and Jordan.
The Israeli Angle
In Israel, a daily cyber war is being waged. The Shin Bet and the National Cyber Directorate thwart hundreds of targeted attack attempts against senior officials, journalists, and academics. Most attacks come from Iranian intelligence elements operating "spear phishing" to steal passwords and authentication codes.
Israel ranks second in the world after the United States in the scope of cyber threats. Unlike criminal groups such as ShinyHunters, the main threat to Israel comes from state actors, primarily Iran, who combine cyber attacks with strategic objectives.
The FBI Under Fire
In September 2026, the FBI released its first public cyber strategy. Head of the Cyber Division, Brett Leatherman, sent a message to group members: "We know how to find you. I suggest you reach out to us first." The FBI director added: "There is no safe haven."
Ironically, the breach of the FBIJobs.gov site stemmed from a security failure by an external contractor who failed to implement security patches—illustrating just how weak the technology supply chain is.
The Cooperation and the Big Question: The King Opens His Devices
Immediately after the handcuffs locked on him in Amman, Saif al-Din Khadr began leading investigators step by step through the maze of his encrypted devices and platforms. The Jordanian teen became a critical key for authorities, assisting in identifying his crime partners and mapping the distributed and elusive structure of the crime collective.
At the FBI's top levels, they maintained a policy of ambiguity and refused to refer specifically to the teen's arrest, but sent a clear message: the agency is conducting an offensive and aggressive investigation in close cooperation with international partners. Thick hints voiced by senior FBI officials made it abundantly clear to "Rey's" partners that the ground is burning beneath their feet.
Now, as the smoke from the breaches begins to dissipate, the biggest and most exciting question occupying the global cyber community remains unanswered, did Khadr indeed retire from criminal activity already in 2025 as he claimed in that dramatic conversation, or did he continue operating the well-oiled extortion machine until the moment of arrest in September 2026? And will his cooperation lead to a broad collapse of the network?
What Does This Say About the Next Generation of Hackers? The Child Prodigies of Online Crime
"Rey's" remarkable story mirrors a broader, deeper, and far more troubling phenomenon: a new generation of brilliant young people and teens, losing their way within a thicket of dark forums, social networks, and available technological tools. They operate from countries where local law enforcement is complex, exploit distributed and faceless structures, and manage to cause enormous economic damage estimated at hundreds of millions of dollars.
The dramatic arrest in Amman, alongside its parallel in the Netherlands, perhaps marks a historic turning point. The Federal Bureau of Investigation and its international partners are proving that their long arm can reach even into the Middle East. But make no mistake, the battle in cyberspace is far from over. Groups like ShinyHunters and their ilk continue to splinter, reorganize under different names, and invent new attack methods for tomorrow.
Saif al-Din Khadr, the Jordanian teen who chose to grant himself the pretentious title "King," now finds himself on the dark and completely different side of the screen. Will he become a central state witness who breaks the mold and brings down his partners, or will his thrilling story ultimately remain just another chapter in the endless saga of cybercrimes of the 2020s? Time will tell.
