What the Jordan detention reports have confirmed

What happened

On October 3, 2026, Reuters reported that Jordanian authorities had detained Saif al-Din Khader, whom the report describes as a suspected member of ShinyHunters known as Rey. Reuters said three people familiar with the matter were the source of the detention, and that two of them placed it on Tuesday. Reuters said it could not determine the circumstances or where he was being held, and that two sources said he was helping investigators locate other people in the group. The FBI, in the same report, declined to comment on any specific arrest abroad and said it continues to investigate the alleged incident. The National, on October 4, reported that Jordan's state television quoted an official confirming an arrest, with investigations ongoing, and that the official did not name the suspect. The page filing those accounts is Futureweb.

What is attributed, and to whom

The name, the nickname, the Tuesday timing, and the claim of cooperation are Reuters's, from unnamed people familiar with the matter. The National's addition is the Jordanian confirmation of an arrest, without an identity in the official line it quoted. The Record reported the detention as well, following the same outline. None of the three is a charging document. A reader who wants the name to be the FBI's name will not find it in the bureau's sentence. That sentence, as Reuters printed it, refuses comment on any specific arrest and says the bureau has already worked with partners to arrest multiple subjects in the broader investigation. Those earlier arrests are not identified in the sentence.

What this page will not reconstruct

Outlets covering the detention also refer to a claimed intrusion against the FBI. This page does not describe that intrusion, the tools, or the path. The fact being filed is the detention report and the gap between a name in a wire story and a name in an official statement. An advisory that names a product and a fixed version is a different kind of security document, filed as the advisory.

Why it matters on this desk

This desk files what a reader can check. Here the check is short. Reuters names a person and says the FBI would not confirm the arrest. Jordan, in The National's account, confirms an arrest and does not give the name. Those two sentences can both be true, and they are not the same sentence. Treating the wire name as a court finding would close a gap the sources left open. The desk is Security.

Where the accounts line up

Reuters, The National, and The Record agree that a suspected ShinyHunters member was reported detained in Jordan and that cooperation with investigators was part of the account. They do not agree on what is official. Only The National cites a Jordanian official, and that official's quoted line omits the identity. Only Reuters prints the FBI's refusal to confirm this arrest, in the wording above. BleepingComputer's later item restates the Reuters account. It is not an independent official record, and it is not a source on this page. A privacy question about what a holder still controls is Privacy.

What a reader can check

The check is the pair of documents. In the Reuters story: the name, three sources, two of them saying Tuesday, no location, FBI declining to confirm this arrest. In The National: an official confirmation of an arrest last week, investigations ongoing, no identity. A tweet, a nickname in a forum, or a reconstruction of an intrusion fails the check. What a CVE identifier is, which this detention report is not, is what a CVE identifier is.

What to watch next

The page changes when a court, a Jordanian named statement, or the FBI attaches the name Saif al-Din Khader to a charge or confirms the detention. Until then the name sits in Reuters's sourcing, and the official Jordanian line The National quoted does not carry it. A later story that adds a courthouse and a docket number replaces this one. A later story that repeats the nickname does not.

What would change the record

An indictment, an extradition notice, or an FBI statement that names this detention would change the sentences above. A retraction of the Reuters sourcing would change them too. The October 3 and October 4 stories are the record this page has. They support a reported detention, a Jordanian confirmation of an unnamed arrest, and an FBI refusal to confirm the specific arrest. They do not support a conviction.

What stays a sourcing gap

What stays specific is the gap. A wire service named a man. A Jordanian official, quoted by The National, confirmed an arrest and withheld the name. The FBI, quoted by Reuters, would not confirm this arrest. That is the security fact. It is not a how-to, and it is not a finding of guilt. The Record's headline reports the same detention and the same assistance claim. It is a third outlet on the wire, not a court file or a charge. It does not add a docket, a charge, or an FBI confirmation. Until one of those exists, the three accounts stay reports.