A teenager from Amman, Jordan, suspected of leading the prolific and aggressive data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to identify other members of the hacking collective.

According to reports from KrebsOnSecurity, the suspect—who operates under the hacker handle “Rey”—was taken into custody just as ShinyHunters was actively extorting a business unit recently divested by the global aerospace and defense giant Boeing. Intriguingly, Boeing happens to manufacture the fleet of passenger aircraft operated by Royal Jordanian Airlines, the very company that employs the suspect’s father.

On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been detained by Jordanian law enforcement and was actively assisting the FBI. KrebsOnSecurity previously identified Rey as Khader in a November 2025 profile, during which the young man admitted to maintaining affiliations with multiple ransomware and extortion groups.

Rey re-entered the global spotlight in a September 28 exclusive detailing the arrest of 24-year-old convicted Dutch cybercriminal Pepijn van der Stap by Netherlands police. Van der Stap was apprehended on suspicion of assisting ShinyHunters with their widespread data thefts and corporate extortion campaigns. Investigators noted that immediately following the Dutchman’s dramatic arrest on the evening of September 15, Rey seized operational control of the ShinyHunters brand. He quickly began publicly boasting about stealing highly sensitive data from the FBI and attempting to extort the notorious ransomware group Cl0p.

In an apparent attempt to mislead investigators and frame Van der Stap for the high-profile cyberattacks, Rey taunted both the FBI and Cl0p by posting a series of memes to his long-standing Twitter/X account. These digital taunts prominently featured images of the avatar used by Van der Stap during his former hacker days under the alias “Umbreon,” a nod to the well-known Pokémon character.

The technical vector behind these breaches involved the mass exploitation of Oracle PeopleSoft servers. As detailed in previous security reports, ShinyHunters gained unauthorized access to the FBI recruitment website and numerous other corporate targets by exploiting a critical vulnerability cataloged as CVE-2026-35273. This flaw affected Oracle’s PeopleSoft platform, a widely utilized software-as-a-service solution that enterprises rely on to manage hiring, human resources, employee benefits, and payroll operations.

Oracle moved quickly to issue a security update after ShinyHunters began weaponizing the vulnerability as a zero-day exploit in June. Around the same time, cybersecurity firm Mandiant released specialized web application firewall (WAF) rules designed to protect organizations that were unable to apply the official Oracle patches immediately.

While BleepingComputer reported in June that the hackers initially targeted the FBI’s PeopleSoft database—though those early attempts reportedly failed—ShinyHunters later adapted their tactics. In recent weeks, the threat actors bypassed Mandiant’s defensive WAF rules by employing a classic URL-encoding trick.

In a joint threat intelligence report released on September 25, security experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had successfully mass-exploited the PeopleSoft vulnerability. The campaign compromised data across dozens of organizations operating in diverse sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.

Further fallout from the breach emerged when Reuters reported on October 5 that the FBI terminated a contract with an Accenture vendor. The contractor was reportedly removed after failing to timely patch the FBI recruitment portal compromised by ShinyHunters, an incident that exposed sensitive records belonging to more than 5,000 FBI personnel, including individual unit assignments, specializations, and confidential medical and psychiatric records.

“Rey” Means King, as in Royal

Sources familiar with the ongoing international investigation revealed that a digital aviation and navigation unit recently divested by Boeing was among the active victims on ShinyHunters’ extortion list when Jordanian authorities moved in to arrest Rey.

The attempted extortion of the former Boeing unit added immense urgency to the FBI’s investigation, particularly because the compromised data involved sensitive operational information that could pose direct safety and security risks.

In a brief statement provided to KrebsOnSecurity, Boeing acknowledged that it was aware of extortion threats from threat actors concerning data linked to Jeppesen ForeFlight. Boeing sold this aviation subsidiary in November 2025 to the private equity firm Thoma Bravo for a staggering $10.55 billion.

"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated. "Estamos actively reviewing the matter with the Jeppesen ForeFlight team."

Conversely, a spokesperson for Jeppesen ForeFlight downplayed the operational impact in a written response, assuring stakeholders that the company’s rigorous security posture protected its core assets. "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products," the company said.

Rey’s alleged involvement in targeting the aviation unit carries ironic weight given his family background. Strong evidence indicates that his father is employed by Royal Jordanian Airlines, a carrier majority-controlled by the Jordanian government that operates its long-haul fleet using Boeing aircraft. Rey himself boasted on Telegram in early 2025 that his father worked as an airline pilot, though investigators could not independently verify that specific claim.

However, a November 2025 profile by KrebsOnSecurity revealed that a shared family computer had previously been compromised by password-stealing malware. Forensic analysis of the harvested logs showed that Rey’s father routinely used identical login credentials across multiple online administrative portals belonging to Royal Jordanian Airlines.

Royal Jordanian Airlines has not responded to requests for comment regarding the security incident. Ahead of the September 28 report, investigators reached out to Rey’s father to apprise him of his son’s alleged criminal activities. Neither family member responded to inquiries. Within hours of that outreach, however, Rey began aggressively scrubbing his digital footprint, deleting numerous social media profiles—including the Twitter/X account he used to mock the FBI, Cl0p, and corporate victims.

Despite purging his primary social media accounts, Rey’s cybersecurity blog hosted on GitHub managed to survive the digital cleanup. The blog highlights Rey’s intense fixation on the leadership behind the Cl0p ransomware operation. A lengthy post published in March 2026 attempted to dox two Russian men alleged to be the core developers and masterminds behind Cl0p, one of the longest-running and most destructive ransomware enterprises active today.

Murder for Hire Allegations in the Netherlands

Meanwhile, Dutch media outlets have brought to light explosive new allegations concerning Pepijn van der Stap, whose narrative of personal rehabilitation from a convicted cybercriminal to a reformed white-hat professional had previously garnered positive coverage in tech circles.

According to a report published on September 29 by the Dutch daily news outlet RTL, local investigators suspect Van der Stap of attempting to orchestrate at least two murders. Authorities believe these planned attacks were intended to take place abroad, and evidence suggests Van der Stap directly issued orders for the executions.

Van der Stap had recently completed the majority of a four-year prison sentence for extensive data theft and extortion activities. Prosecutors estimated those earlier crimes had netted between 1.5 million and 2.7 million euros. In an interview conducted on September 9, Van der Stap described his post-prison employment as the "offensive security lead" at Neo Security, a Dutch cybersecurity firm where his responsibilities supposedly included auditing client networks for vulnerabilities.

Benjamin Korper, the owner of Neo Security, told Reuters that he hired an independent forensic firm to investigate whether Van der Stap had compromised his company or its clients. Thus far, investigators have found no evidence that Van der Stap acted maliciously against his employer. Korper added that Dutch forensic teams searched his office on September 15 during a high-profile police raid that reportedly involved the use of flash-bang grenades.

Before his initial arrest in 2023, Van der Stap worked as a software engineer for Hadrian, an Amsterdam-based cybersecurity startup, while simultaneously volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD)—all while secretly breaching and extorting major global corporations.

When questioned about how the public could trust a self-proclaimed reformed hacker with a history of deceiving colleagues and journalists, Van der Stap maintained that his technical contributions would ultimately speak for themselves.

"You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," Van der Stap remarked in September. "I’m doing what I can to repay victims, and that’s all I can do. If someone doesn’t want to believe me, then that’s on them."

Franchising Cybercrime and Burning a Brand

Cybercriminals operating under the ShinyHunters banner are tied to dozens of massive data breaches accounting for billions of stolen records, with campaigns dating back to at least 2019. Security experts emphasize, however, that the individuals currently wielding the ShinyHunters moniker bear little relation to the group’s original core members, most of whom are French nationals who have faced arrest and prosecution for prior cyber offenses.

Security analysts view ShinyHunters less as a traditional closed-group hacking crew and more as an open franchise model. The operational structure functions much like the Dread Pirate Roberts persona from the classic film The Princess Bride, where succession occurs not through death, but through arrest—allowing multiple individuals to adopt the identity simultaneously. Sources indicate that current federal investigations focus on a revolving group of freelance cybercriminals who trade stolen software credentials from major corporate platforms in exchange for a percentage of any ransom payouts.

Following the news of Van der Stap’s arrest, underground Telegram channels allegedly operated by Rey descended into chaos. Former associates mocked the teenager after he publicly backed down from threats made against the FBI and Cl0p, a humiliation compounded when the ShinyHunters dark web portal suddenly went offline. Commentators accused Rey of hijacking the defunct group’s brand identity for personal financial gain.

"He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke," one underground community member noted.

A newly emerged Telegram channel titled "The Battle" has spent weeks doxing and harassing Rey and other alleged associates. Channel administrators characterized Rey as an inexperienced novice attempting to leverage a notorious brand name to punch above his weight class.

"Rey (Saif Al-Din Khader) made a serious mistake when he started pretending to be a member of ShinyHunters," the administrators of The Battle wrote. "That group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes."

In an interview with The Register, representatives for ShinyHunters claimed their decision to hack the FBI was a direct response to a May security advisory issued by the agency warning victims against paying ransoms. The hackers argued that the public advisory undermined their business model by portraying them as unreliable.

While the FBI’s flash notice warned that the group frequently employs aggressive harassment strategies—including threatening phone calls, text messages, swatting incidents, and the false claim of holding compromising personal photographs—the hackers asserted that their breach of the bureau was executed to reassert their technical capabilities and counteract public warnings issued by law enforcement and researchers.