By Global Investigative Desk
Published: October 2025
Main Facts
The United States Federal Bureau of Investigation (FBI) has found itself reeling from one of the most brazen data breaches in its history, a massive compromise of personal data linked to the notorious cybercrime syndicate ShinyHunters. At the center of the unfolding international drama is a teenager—identified by former associates and cybersecurity researchers as 17-year-old Saif al-Din Khader, who went by the hacker moniker "Rey."
According to close associates, Khader was allegedly a key player in the catastrophic breach. However, long before federal investigators closed in, Khader was warned by one of his closest childhood friends and former fellow cybercriminals that his ambition to target the premier U.S. law enforcement agency was pure suicide.
Adem El Adeb, a 19-year-old living in the United Arab Emirates who formerly operated under the hacker alias "Pryx," revealed in an extensive interview that he desperately tried to talk Khader out of attacking the FBI. In early September message exchanges, El Adeb warned his longtime friend that breaking into the federal bureau would bring the full, crushing weight of the United States government down upon him.
"You’re suicidal," El Adeb recalled telling Khader. "I told him he was crazy and that he should drop the idea. Not only once. Multiple times. I tried to advise him."
Despite these warnings, Khader allegedly pressed forward. The breach—which the FBI has told staffers it is treating under the assumption that it compromises personal data pertaining to all of its employees—has sent shockwaves through national security apparatuses. Khader was ultimately taken into custody by authorities in Jordan on September 29, and sources familiar with the matter indicate he is currently cooperating with the bureau’s ongoing investigation.
Chronology of an Underworld Partnership
The trajectory of Saif al-Din Khader and Adem El Adeb offers a rare, inside look at how modern cybercriminal syndicates cultivate young, highly skilled talent—often starting innocently before devolving into high-stakes international extortion.
Preteen Beginnings and Hacktivism
According to El Adeb, who was born in Tunisia before his parents relocated to the UAE for work, his relationship with Khader began online when they were just 11 or 12 years old. As preteens experimenting with the foundational elements of computer science and networking, the pair bonded over a shared, passionate support for the Palestinian cause.
Initially, their digital incursions were rudimentary. They engaged in low-level website defacements, viewing their actions through the lens of youthful political rebellion.
"We thought it was cool when we were kids," El Adeb reflected during a video interview from the Gulf emirate of Ras Al Khaimah. "But then we grew out of it. We started to think that hacktivism is cringe."
The Rise of Hellcat and Corporate Extortion
As the duo matured into their mid-teens, their motivations shifted away from ideological defacements toward financial gain and digital notoriety. Khader, El Adeb, and other young, geographically dispersed cybercriminals formed a short-lived but impactful cybercrime collective known as Hellcat.
Emerging publicly in 2024, Hellcat quickly made headlines by breaching high-profile global organizations. Among their most infamous exploits was a targeted intrusion into French multinational energy and automation digital systems provider Schneider Electric (SCHN.PA). In a move that underscored the group’s penchant for psychological humiliation and "trolling," the hackers infamously demanded a ransom paid entirely in $125,000 worth of French baguettes.
Analysts noted that Hellcat stood out from traditional, stealthy ransomware gangs due to its aggressive public shaming of victims—a tactic El Adeb openly characterized as mere amusement or "trolling."
Exposure and Exits
The digital trail left by Hellcat eventually caught the attention of cybersecurity researchers. In March 2025, Israeli cybersecurity research firm Kela circulated an investigative report—subsequently reviewed by Reuters—that formally unmasked "Rey" as Saif al-Din Khader and "Pryx" as Adem El Adeb.
The Kela report successfully tied Pryx to El Adeb by uncovering that the hacker’s criminal ventures shared digital infrastructure, software tools, and communication channels with a security-focused website called Pato, a guide that had once explicitly listed El Adeb as its author.
Confronted with the closing net of international cybersecurity tracking, El Adeb claims he made a conscious decision to walk away from illegal operations. He insists he abandoned cybercrime entirely before turning 18. Today, he presents himself as a "retired threat actor" who has traded malicious exploits for legitimate enterprise, setting up a new cybersecurity startup named VulOne alongside a cofounder.
"I’m clean now," El Adeb stated, chain-smoking Emirati Manchester Red cigarettes throughout the hour-long interview.
Supporting Data and Technical Insights
While independent verification of the absolute scope of the FBI data breach remains under tight wraps due to active federal investigations, the digital footprint left by Khader and his associates is heavily documented by threat intelligence analysts.
- The Scale of the FBI Intrusion: While Reuters has not independently verified every file exfiltrated in the incident, internal communications reveal that the FBI leadership is operating under a worst-case scenario framework. A source briefed on the matter confirmed that staffers were told to assume the leaked cache encompasses records on every single employee within the bureau.
- The Kela Threat Intelligence Report: Released in March 2025, the Kela report served as a cornerstone in exposing the real-world identities behind the avatars Rey and Pryx. By mapping shared command-and-control servers, codebase signatures, and historical author profiles, researchers bridged the gap between anonymous cybercriminal handles and individuals residing in the Middle East and North Africa.
- The ShinyHunters Connection: The breach sits within a broader wave of high-profile cyberattacks orchestrated by the ShinyHunters network—a collective notorious for massive database thefts, corporate extortions, and data leaks. Khader’s alleged involvement places him at the nexus of several major international cyber investigations.
- Parallel Arrests in the Global Cyber Underworld: The crackdown on youthful elite hackers has extended far beyond Jordan. On September 15, Dutch authorities arrested Pepijn van der Stap, another suspected member of the ShinyHunters ecosystem. Much like Khader and El Adeb, Van der Stap had repeatedly assured journalists in the past that he had left his days of theft and extortion behind him. However, Dutch police are now investigating Van der Stap over grave allegations that extend beyond mere data theft, including attempts to organize murders abroad.
Official Responses and Bureau Silence
The response from United States federal law enforcement to the ShinyHunters breach has been aggressive, methodical, and largely tight-lipped.
The FBI has repeatedly declined to comment on Adem El Adeb’s detailed account of his messaging history with Saif al-Din Khader, nor has the bureau officially confirmed the precise mechanics of how the teenage hackers managed to bypass federal cybersecurity perimeters. In public statements, the bureau has maintained that it is aggressively investigating the ShinyHunters hack, leveraging domestic and international law enforcement partnerships to track down every individual involved in the exfiltration and dissemination of the sensitive personnel data.
International cooperation proved pivotal in the apprehension of Khader. Acting on intelligence shared across international jurisdictions, Jordanian authorities detained the 17-year-old on September 29. According to individuals familiar with the proceedings, Khader has transitioned from a defiant digital operative to a cooperating witness, providing federal investigators with vital intelligence regarding the internal operations, communication channels, and monetization strategies of the ShinyHunters group.
Attempts by international news agencies to reach Khader, members of his immediate family, or legal representatives appointed on his behalf have been unsuccessful. Similarly, attempts to secure statements from representatives for Pepijn van der Stap following his Dutch arrest have yielded no results.
Broader Implications for Global Cybersecurity
The saga of Saif al-Din Khader, Adem El Adeb, and the ShinyHunters FBI breach highlights several alarming trends and systemic vulnerabilities in the modern digital landscape.
1. The Low Age Threshold of Advanced Threat Actors
The breach underscores a stark reality of 21st-century cybercrime: advanced persistent threats (APTs) and high-level extortion rings are increasingly driven by individuals who began their malicious trade as preteens. With global communication platforms allowing 11- and 12-year-olds to form cross-continental alliances, traditional age demographics no longer apply to sophisticated cyber threats. By the time these individuals reach their late teens, they possess years of hands-on operational experience that rivals veteran criminal syndicates.
2. The Illusion of Retirement in the Cyber Underworld
Both Khader and Van der Stap reportedly told researchers and journalists in the past that they had walked away from cybercrime. Yet, as recent events demonstrate, the line between retirement and active threat participation is remarkably porous. While El Adeb claims to have successfully transitioned into legitimate enterprise with his startup VulOne, his ongoing reflections—characterized by a striking lack of remorse and a sense of pride in his criminal past—illustrate the complex psychology of young hackers.
"I’m proud that I had this experience," El Adeb remarked candidly. "I’m actually very happy and proud that I had actual cybercrime experience in a field that is filled with people that claim they know stuff but they never actually experienced real hacking."
3. Vulnerability of National Security Infrastructure
Perhaps the most significant implication of the incident is the profound vulnerability exposed within elite government institutions. If a loose collective of teenage hackers orchestrated by individuals like Khader could successfully execute a breach resulting in the compromise of personal data across an entire federal intelligence and law enforcement agency like the FBI, it signals an urgent need for a fundamental re-evaluation of zero-trust architectures, supply chain security, and internal credential management across all levels of government.
As the federal investigation continues to unfold—bolstered by Khader’s cooperation from a Jordanian detention facility—the fallout from the ShinyHunters FBI breach will likely reshape cybersecurity policies, international extradition protocols, and the legal frameworks used to prosecute juvenile cybercriminals for years to come.
