A teenager from Amman, Jordan, suspected of leading the prolific data theft and extortion group ShinyHunters, has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang, according to KrebsOnSecurity. The suspect, who uses the hacker handle "Rey," was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing. This unit, Jeppesen ForeFlight, is a navigation and digital aviation provider. Notably, Boeing is the manufacturer of the planes used by Royal Jordanian Airlines, the employer of Rey’s father.

On October 3, Reuters cited three unnamed sources stating that a suspected ShinyHunters member in Amman named Saif Al-din Khader was detained by Jordanian authorities and was cooperating with the FBI. KrebsOnSecurity had previously identified Rey as Khader in a November 2025 profile, where the young man admitted to working with multiple ransomware groups. Rey was again featured in a September 28 exclusive detailing the Dutch police’s arrest of 24-year-old convicted cybercriminal Pepijn van der Stap on suspicion of aiding ShinyHunters in data thefts and extortions. The report noted that immediately following Van der Stap’s arrest on the evening of September 15, Rey assumed control over the ShinyHunters brand and publicly boasted about stealing highly sensitive data from the FBI and extorting the ransomware group Cl0p. Rey taunted both the FBI and Cl0p with memes posted to his Twitter/X account, while simultaneously including images of the avatar used by Van der Stap’s former hacker alias "Umbreon" in an apparent attempt to frame the Dutchman for both hacks.

As noted in the September 28 report, ShinyHunters gained access to the FBI site and other victims by exploiting a vulnerability (CVE-2026-35273) in PeopleSoft, a software-as-a-service platform from Oracle. This platform is broadly used by companies to manage hiring, human resources, benefits, and payroll. Oracle quickly issued a fix for CVE-2026-35273, which ShinyHunters had begun exploiting as a zero-day in June. At the time, Mandiant released web application firewall rules for organizations unable to apply the security update promptly. In June, ShinyHunters told BleepingComputer that their original goal was to breach the FBI’s PeopleSoft database, but these attacks were unsuccessful for unknown reasons. In recent weeks, however, ShinyHunters employed a well-known URL-encoding trick to bypass Mandiant’s suggested web application firewall rules.

A report released on September 25 by security experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability, stealing data from dozens of systems across various industries, including higher education, technology, healthcare, agriculture, transportation, and government. Reuters reported on October 5 that the FBI had removed a contractor at Accenture due to their failure to patch the FBI recruitment website hacked by ShinyHunters. This breach exposed sensitive data on over 5,000 FBI personnel, including their unit and specialization, as well as medical and psychiatric records.

"Rey" means king, as in royal. According to two sources familiar with the ShinyHunters investigation, a navigation and digital aviation unit recently divested by Boeing was among the victims that ShinyHunters was in the process of extorting when Rey was apprehended by Jordanian authorities. These sources stated that the FBI’s investigation into ShinyHunters gained renewed urgency with the group’s attempted extortion of the former Boeing unit, which allegedly involved the theft of sensitive information that could pose operational safety and security risks.

In a brief statement shared with KrebsOnSecurity, Boeing acknowledged the extortion attempts by ShinyHunters, confirming the incident concerned data stolen from Jeppesen ForeFlight, a subsidiary that Boeing sold in November 2025 to the private equity firm Thoma Bravo for $10.55 billion. A Boeing spokesperson stated, "We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight. We are actively reviewing the matter with the Jeppesen ForeFlight team." A spokesperson for Jeppesen ForeFlight responded, "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products."

Rey’s alleged involvement in attempting to extort the former Boeing unit is noteworthy because strong evidence suggests his father works for Royal Jordanian Airlines, a company largely controlled by the Jordanian government and operating its long-haul fleet on passenger planes built by Boeing. Rey had claimed on Telegram in early 2025 that his father was an airline pilot, though this could not be independently confirmed. However, as noted in the November 2025 profile of Rey, his family’s shared computer was once compromised by password-stealing malware, and the collected data clearly showed Rey’s father used the same credentials to log in to multiple online portals for Royal Jordanian Airlines employees. Royal Jordanian Airlines has not yet responded to a request for comment. In advance of the September 28 story, KrebsOnSecurity again emailed Rey’s father for comment and to update him on his son’s alleged activities. Neither of the Khaders have responded. However, just hours after that request was sent, Rey began deleting his various social media accounts, including the Twitter/X account he previously used to taunt the FBI, Cl0p, and other ShinyHunters victims.

Rey may have deleted many of his social media profiles, but his cybersecurity blog on GitHub survived the purge, revealing Rey’s fixation on the leaders of the Cl0p ransomware group. In March 2026, Rey’s blog featured a lengthy post identifying two Russian men as the core developers and hackers behind Cl0p, one of the oldest and most established ransomware groups still in operation.

Meanwhile, news outlets in the Netherlands reported explosive new allegations leveled at Pepijn van der Stap. RTL reported on September 29 that investigators suspect Van der Stap attempted to orchestrate at least two murders abroad, with indications that he gave the order for these attacks. Van der Stap was released from prison after serving the better part of a four-year sentence for data theft and extortion activities that prosecutors claimed netted between €1.5 million and €2.7 million. In an interview with KrebsOnSecurity on September 9, Van der Stap described his new role as "offensive security lead" at the Dutch cybersecurity company Neo Security, stating the job involved probing client networks for security vulnerabilities. Neo Security’s owner, Benjamin Korper, told Reuters he had hired an outside firm to investigate whether Van der Stap had hacked Neo Security or its customers, but so far, investigators found no evidence of him acting against his employer or clients. Korper stated that Dutch forensic investigators visited his office on September 15, the night Van der Stap was arrested in a dramatic police raid that reportedly involved flash-bang grenades. Prior to his first arrest in 2023, Van der Stap was working as a software engineer at the Amsterdam-based cybersecurity startup Hadrian, while volunteering at the Dutch Institute for Vulnerability Disclosure (DIVD), even as he was hacking into and extorting a number of large organizations. When asked in a recent interview why anyone should believe the word of a self-described "reformed" cybercriminal who had so casually deceived friends, co-workers, and journalists for years, Van der Stap replied that his work spoke for itself and there was nothing he could say that would convince his worst critics.

Franchising and Burning a Brand. Cybercriminals aligned with ShinyHunters have been responsible for dozens of data breaches involving billions of stolen records, with breaches claimed by the group stretching back to at least 2019. However, experts suggest that the individuals recently operating under the ShinyHunters name are not the same core members from its early days, most of whom were French citizens who had been arrested, if not imprisoned, on at least one prior occasion for alleged cybercrime activity. More significantly, ShinyHunters has become something of a franchise, akin to the Dread Pirate Roberts character in "The Princess Bride," where succession occurs through arrest rather than death, and multiple individuals can hold the title simultaneously. Sources close to the investigation indicate that the FBI is focusing on a remaining handful of cybercriminal freelancers or affiliates who have been feeding the group stolen credentials to various software-as-a-service (SaaS) platforms used by major companies, in exchange for a cut of any data ransoms paid by victims.

In the days following the news of Van der Stap’s arrest, a cybercrime-focused chat server on Telegram, allegedly operated by Rey, erupted with discussions, with most participants ridiculing the teenage hacker after he publicly backed down from threats against the FBI and Cl0p, and again when the ShinyHunters darknet website suddenly went offline. Several commentators accused Rey of resurrecting the ShinyHunters brand after its core members were rounded up in France, and of making a mockery of the group’s name and reputation ever since. "He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke," one member recounted. A relatively new Telegram channel called "The Battle" has been doxing and needling Rey and other alleged ShinyHunters members for several weeks, gaining a considerable readership among cybercrime communities on Telegram. One of the coordinators of that harassment campaign repeatedly portrayed Rey as a clueless greenhorn who sought to ride the coattails of a cybercriminal brand that has long enjoyed a reputation for ruthlessly selling or publishing data stolen from victim companies who refuse to give in to extortion demands. "Rey (Saif Al-Din Khader) made a serious mistake when he started pretending to be a member of ShinyHunters," wrote the administrators of The Battle server on Telegram. "That group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes. We’re aware of claims that [Rey] caused over $200 million in damages and helped around 5–6 friend groups in the community make money by using Shiny Hunters group aliases to negotiate deals for a 25–30% cut over the past few months."

In an interview with The Register, ShinyHunters claimed they hacked the FBI to counter the agency’s narrative in a May 2026 alert that advised victims against paying a ransom to the group, which came off looking unprofessional and capricious in the FBI’s advisory. The public notice warned that the group had been known to pursue a number of different victim harassment strategies, from sending threatening text messages and phone calls to victims and their family members, to in some cases swatting victims. The FBI warned ShinyHunters members "may also falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist." The hackers told The Register their attack on the FBI "demonstrated our technical capabilities and directly refuted the misinformation disseminated by the FBI, journalists, and industry researchers." At the same time, the group’s leaders seemed to acknowledge that the FBI’s warning materially harmed their prospects for convincing victims to pay, stating, "this was fundamentally a public relations and marketing initiative for our business."