A teenage suspect from Amman, Jordan, suspected of leading the prolific and aggressive data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to identify other members of the hacking collective.

According to intelligence gathered by KrebsOnSecurity, the suspect—who operates online under the hacker handle "Rey"—was apprehended at a critical juncture. The arrest unfolded just as ShinyHunters was actively attempting to extort a business unit recently divested by the global aerospace giant Boeing. In a striking twist of international intrigue, the target of the extortion manufactures the very fleet of passenger aircraft operated by Royal Jordanian Airlines, the employer of Rey’s father.

The international dragnet tightened significantly on October 3, when Reuters cited three unnamed sources confirming that a suspected ShinyHunters operative in Amman named Saif Al-din Khader had been detained by Jordanian law enforcement and was actively cooperating with federal U.S. investigators. KrebsOnSecurity previously identified Rey as Khader in a detailed investigative profile published in November 2025, in which the young man openly admitted to collaborating with multiple ransomware operations.

Rey’s digital footprint surfaced once more in a September 28 exclusive covering the Dutch police arrest of 24-year-old convicted cybercriminal Pepijn van der Stap. Authorities suspect Van der Stap aided and abetted data thefts and extortion campaigns orchestrated by ShinyHunters. According to the reporting, immediately following the Dutchman’s dramatic arrest on the evening of September 15, Rey seized operational control of the ShinyHunters brand. He quickly took to public platforms to boast about breaching highly sensitive data belonging to the FBI and successfully extorting the rival ransomware operation known as Cl0p.

In an elaborate campaign of cyber-taunts, Rey mocked both federal law enforcement and the Cl0p syndicate using memes posted to his long-standing Twitter/X account. Simultaneously, he embedded the distinct avatar of Van Der Stap’s former hacker alias, "Umbreon," into the posts in what investigators believe was a deliberate attempt to frame the Dutch national for the high-profile breaches.

The Exploitation of Oracle PeopleSoft

As detailed in previous cybersecurity disclosures, ShinyHunters managed to infiltrate the FBI’s recruitment portal and compromise numerous other corporate victims by exploiting a critical vulnerability—tracked as CVE-2026-35273—in Oracle PeopleSoft. This software-as-a-service (SaaS) platform is widely utilized by major enterprises worldwide to manage internal human resources, payroll systems, employee benefits, and hiring pipelines.

Prompted by the zero-day exploits that began surfacing in June, Oracle rapidly issued a security patch to neutralize CVE-2026-35273. Simultaneously, security firm Mandiant released specialized web application firewall (WAF) rules to protect organizations unable to immediately apply the vendor update.

However, ShinyHunters initially confided to BleepingComputer in June that their primary objective was penetrating the FBI’s proprietary PeopleSoft database itself, though those initial attempts reportedly fell short. In subsequent weeks, the threat group adapted, utilizing a well-known URL-encoding bypass trick to circumvent Mandiant’s recommended firewall defenses.

A comprehensive threat intelligence report released on September 25 by experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had successfully executed a mass-exploitation campaign targeting the PeopleSoft vulnerability. The attacks compromised data across dozens of organizations spanning diverse critical sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.

Further compounding the fallout, Reuters reported on October 5 that the FBI terminated a contractor at Accenture following an investigation into a catastrophic failure to patch the compromised FBI recruitment portal. The breach exposed sensitive personnel records belonging to more than 5,000 FBI employees, including detailed assignments, unit specializations, and confidential medical and psychiatric histories.

"Rey" Means King, As in Royal

According to two sources familiar with the ongoing international investigation into ShinyHunters, the digital navigation and aviation division recently divested by Boeing was right in the crosshairs of an active extortion scheme when Jordanian authorities moved in to arrest Rey.

Investigators familiar with the case noted that the FBI’s pursuit of the ShinyHunters network gained intense urgency following the targeting of the former Boeing unit. The stolen data allegedly contained proprietary and operational information capable of presenting severe safety and security risks.

In a brief official statement provided to KrebsOnSecurity, Boeing acknowledged the attempted extortion campaign, confirming that the incident involved data pilfered from Jeppesen ForeFlight. Boeing had previously sold this navigation subsidiary to private equity firm Thoma Bravo in November 2025 for a staggering $10.55 billion.

"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated. "We are actively reviewing the matter with the Jeppesen ForeFlight team."

Conversely, a spokesperson for Jeppesen ForeFlight maintained that their internal infrastructure remained uncompromised. In a written response, the company asserted, "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products."

Rey’s alleged entanglement in the extortion of the former Boeing division carries profound personal context. Strong forensic evidence indicates that his father is employed by Royal Jordanian Airlines, a carrier majority-controlled by the Jordanian government that operates its long-haul international routes using Boeing aircraft. While Rey claimed on Telegram early last year that his father worked as an airline pilot, that specific detail could not be independently verified.

However, forensic analysis from the November 2025 profile revealed that a family computer utilized in the Khader household had been compromised by infostealer malware. The harvested logs demonstrated that Rey’s father routinely used his credentials to access multiple online employee portals belonging to Royal Jordanian Airlines.

Royal Jordanian Airlines has not yet issued a public response regarding the security implications. Just hours after KrebsOnSecurity reached out to Rey’s father to apprise him of his son’s arrest and ongoing cybercriminal activities, Rey began aggressively scrubbing his digital footprint, deleting multiple social media profiles—including the Twitter/X account used to mock federal investigators and victim organizations.

Despite purging his social accounts, Rey left behind a personal cybersecurity blog hosted on GitHub. The repository revealed a deep, singular fixation on the leadership of the Cl0p ransomware syndicate. In March 2026, Rey published an exhaustive investigative post doxxing two Russian nationals alleged to be the core developers and operators behind Cl0p.

Murder-for-Hire Allegations Surface in the Netherlands

While developments unfolded in Amman, explosive legal allegations emerged in the Netherlands regarding Pepijn van der Stap. Van der Stap had previously cultivated a public narrative portraying himself as a reformed hacker following a four-year prison sentence for data theft and extortion schemes that prosecutors estimated yielded between 1.5 million and 2.7 million euros.

Dutch daily newspaper RTL reported on September 29 that investigators now suspect Van der Stap of attempting to commission at least two contract murders. According to the reports, the planned homicides were intended to be executed abroad, and authorities have uncovered credible indications that Van der Stap issued the orders.

Prior to his September 15 arrest, Van der Stap had secured employment as an "offensive security lead" at Amsterdam-based cybersecurity firm Neo Security, where he claimed his responsibilities involved authorized penetration testing for client networks. In an interview on September 9, Van der Stap maintained that he was dedicated to making amends.

Neo Security owner Benjamin Korper told Reuters that an independent external firm was promptly retained to audit Neo Security and its client networks for signs of internal compromise. Thus far, investigators have found no evidence that Van der Stap weaponized his position against his employer or its clients. Korper confirmed that Dutch forensic officers raided his office on the night of September 15, an operation local media outlets reported involved the deployment of flash-bang grenades.

Before his initial 2023 conviction, Van der Stap worked as a software engineer at Amsterdam cybersecurity startup Hadrian while concurrently volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD)—all while secretly breaching and extorting major commercial organizations.

When questioned about how the public or victims could trust a self-professed reformed cybercriminal who had deceived colleagues and journalists alike, Van der Stap offered a blunt assessment. "You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," he remarked. "I’m doing what I can to repay victims, and that’s all I can do."

Franchising and Burning a Brand

Cybercriminals operating under the ShinyHunters banner are tied to dozens of mass data breaches affecting billions of user records across a timeline extending back to 2019. However, security researchers emphasize that the individuals controlling the moniker today bear little relation to the original core members—mostly French nationals who have faced arrest and prosecution for historic cybercrimes.

Security analysts describe modern ShinyHunters less as a cohesive gang and more as a franchise model. Much like the literary concept of the Dread Pirate Roberts, succession is dictated not by death, but by law enforcement arrests, often resulting in multiple individuals claiming the mantle simultaneously. Investigators suggest the FBI is currently prioritizing a network of freelance cybercriminal affiliates who supply stolen corporate SaaS credentials in exchange for a percentage of any successful ransom payouts.

In the wake of Van der Stap’s arrest, a Telegram chat server allegedly administered by Rey erupted in internal recriminations. Community members openly ridiculed the teenage hacker after he abruptly backed down from public threats against the FBI and Cl0p, a retreat that coincided with the sudden offline status of the ShinyHunters darknet portal.

"He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke," one chat participant alleged.

A dedicated monitoring channel on Telegram known as "The Battle" has systematically doxxed and harassed Rey and other alleged affiliates for weeks, attracting a wide readership within underground cybercrime forums. Administrators of the channel characterized Rey as an inexperienced novice attempting to leverage the notoriety of an already dismantled brand.

"Rey made a serious mistake when he started pretending to be a member of ShinyHunters," write the administrators of The Battle. "That group had already been dismantled, with many of its members either arrested or imprisoned… We’re aware of claims that he caused over $200 million in damages and helped around 5-6 friend groups in the community make money by using Shiny Hunters group aliases to negotiate deals for a 25-30% cut over the past few months."

In a defiant interview with The Register, representatives for ShinyHunters claimed their decision to target the FBI was a calculated response to an agency flash notice published on May 15, 2026, which formally advised organizations against yielding to extortion demands.

The FBI’s advisory warned that the collective frequently employs aggressive harassment tactics—ranging from threatening phone calls and text messages directed at executives and their families to physical swatting incidents. The bureau also cautioned that the group routinely fabricates claims regarding the possession of sensitive or compromising personal media.

The hackers asserted that breaching federal infrastructure served to demonstrate their technical competence and refute official warnings. At the same time, the group conceded that the government’s public awareness campaign severely damaged their commercial prospects, acknowledging that their retaliatory digital assault was "fundamentally a public relations and marketing initiative for our business."