A teenager from Amman, Jordan, suspected of leading the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to identify other members of the global hacking collective.

According to intelligence gathered by KrebsOnSecurity, the suspect—who operates under the hacker handle “Rey”—was taken into custody just as ShinyHunters was in the middle of executing a high-stakes extortion campaign against a business unit recently divested by global aerospace giant Boeing. In a striking twist of geographical coincidence, Boeing manufactures the fleet of aircraft utilized by the employer of Rey’s father, Royal Jordanian Airlines.

The arrest follows a series of international law enforcement developments that have begun to fracture the operational infrastructure of the notorious cybercrime group. On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters operative in Amman named Saif Al-din Khader had been detained by Jordanian law enforcement and was actively cooperating with federal investigators from the United States. KrebsOnSecurity previously identified Rey as Khader in a detailed profile published in November 2025, in which the young man admitted to working alongside multiple ransomware syndicates.

Rey’s activities were thrust into the spotlight once again on September 28, following a report detailing the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap by police in the Netherlands. Van der Stap, a convicted felon, was apprehended on suspicion of facilitating data thefts and extortion schemes for ShinyHunters.

According to investigative findings, immediately following the Dutchman’s dramatic arrest on the evening of September 15, Rey seized control of the ShinyHunters brand identity. He began publicizing high-profile claims, boasting that he had successfully stolen sensitive data from the Federal Bureau of Investigation (FBI) and launched extortion attempts against the competing ransomware group known as Cl0p.

In an effort to deflect attention and hinder investigators, Rey utilized a longstanding account on Twitter/X to taunt both the FBI and Cl0p with custom memes. He embedded images of the avatar previously used by Van der Stap under his former hacker alias, “Umbreon,” in what appeared to be a calculated attempt to frame the Dutch national for the brazen hacks.

The PeopleSoft Vulnerability and Global Enterprise Impact

The operational pivot that enabled ShinyHunters to breach elite targets like the FBI involved the mass exploitation of a security flaw (CVE-2026-35273) within PeopleSoft. This software-as-a-service platform, developed by tech giant Oracle, is widely utilized by major corporations and government agencies worldwide to manage human resources, recruitment, payroll, and employee benefits.

Oracle swiftly issued a security patch after ShinyHunters began weaponizing the vulnerability as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant released web application firewall (WAF) rules designed to protect organizations that were unable to apply the software update immediately.

While BleepingComputer reported in June that the group’s initial objective was targeting the FBI’s own PeopleSoft database—an attempt that initially yielded mixed results—ShinyHunters later adapted their tactics. In subsequent weeks, the hackers bypassed Mandiant’s recommended WAF rules by employing a well-known URL-encoding trick.

By late September, security researchers at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had successfully mass-exploited the PeopleSoft vulnerability. The campaign compromised dozens of systems across a diverse array of industries, including higher education, technology, healthcare, agriculture, transportation, and government sectors.

The fallout from these intrusions proved severe. Reuters reported on October 5 that the FBI terminated a contractor working through Accenture following revelations that a failure to patch the bureau’s recruitment website left a portal vulnerable. The breach exposed sensitive personnel records belonging to more than 5,000 FBI employees, including detailed information regarding individual specializations, unit assignments, and confidential medical and psychiatric records.

‘Rey’ Means King, as in Royal

Investigators familiar with the ShinyHunters case revealed that the group’s relentless push to extort a navigation and digital aviation division recently divested by Boeing added immense urgency to the FBI’s manhunt. Sources noted that the stolen data from this former Boeing subsidiary posed significant operational safety and security risks, prompting intensive law enforcement coordination.

Boeing acknowledged the extortion threats in a statement, confirming that the incident involved data linked to Jeppesen ForeFlight. Boeing had previously sold the subsidiary in November 2025 to private equity firm Thoma Bravo for $10.55 billion.

"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated. "We are actively reviewing the matter with the Jeppesen ForeFlight team."

Conversely, a representative for Jeppesen ForeFlight asserted that the company’s internal security measures had successfully mitigated any potential damage. "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products," the spokesperson declared.

Rey’s alleged role in targeting the former Boeing asset drew intense scrutiny due to his familial ties. Strong evidence indicates his father is employed by Royal Jordanian Airlines, a carrier predominantly controlled by the Jordanian government that operates long-haul flights utilizing Boeing aircraft. Although Rey claimed on Telegram in early 2025 that his father worked as an airline pilot—a detail that could not be independently verified—digital forensics paint a clearer picture.

Data retrieved from a password-stealing malware infection on the Khader family’s shared computer revealed that Rey’s father utilized identical login credentials across multiple administrative portals for Royal Jordanian Airlines employees.

Neither Royal Jordanian Airlines nor the Khader family responded to requests for comment regarding the ongoing investigation. However, shortly after inquiries were sent to Rey’s father ahead of previous reporting, Rey initiated a rapid purge of his digital footprint, deleting numerous social media profiles, including the Twitter/X account used to mock federal law enforcement and corporate victims.

Despite scrubbing his social media presence, Rey left behind a cybersecurity blog hosted on GitHub. A lengthy post published on the blog in March 2026 detailed an investigative doxing attempt targeting two Russian nationals identified by Rey as the core developers and operators behind the Cl0p ransomware syndicate.

Explosive Allegations in the Netherlands

While developments unfolded in Amman, legal proceedings in the Netherlands revealed staggering new accusations against Pepijn van der Stap. The Dutch daily RTL reported that investigators suspect Van der Stap of orchestrating at least two murders intended to be carried out abroad, pointing to indications that he gave direct orders for the plots.

Van der Stap had recently completed a prison sentence stemming from previous data theft and extortion convictions that prosecutors estimated netted between 1.5 million and 2.7 million euros. Prior to his September 15 arrest, Van der Stap participated in an interview describing his employment as an "offensive security lead" at Dutch cybersecurity firm Neo Security, where he claimed his responsibilities included vulnerability testing for client networks.

Neo Security owner Benjamin Korper told reporters that he hired an independent forensic firm to audit Neo Security and its clients for any sign of internal compromise. Investigators reportedly found no evidence that Van der Stap acted maliciously against his employer or clients. The arrest itself involved a high-security police raid utilizing flash-bang grenades at Van der Stap’s residence.

Before his initial legal troubles in 2023, Van der Stap worked as a software engineer for Amsterdam-based cybersecurity startup Hadrian and volunteered with the Dutch Institute for Vulnerability Disclosure (DIVD), all while covertly infiltrating corporate networks. When questioned about his credibility as a self-described "reformed" cybercriminal, Van der Stap maintained that his actions and remediation efforts defined his path forward.

Franchising and Burning a Brand

The broader history of ShinyHunters spans multiple years, with affiliated actors linked to dozens of data breaches involving billions of compromised records since 2019. Security experts emphasize, however, that the individuals currently operating under the ShinyHunters banner represent a distinct generation from the group’s original members—most of whom are French nationals previously apprehended by European law enforcement.

Analysts describe modern cybercriminal syndicates like ShinyHunters as operating on a franchise model. Much like the literary concept of the Dread Pirate Roberts, succession within the group is dictated by law enforcement arrests rather than mortality, allowing multiple individuals to adopt the mantle simultaneously. Investigators suggest the FBI has concentrated its efforts on uncovering freelance affiliates who trade stolen SaaS credentials for a percentage of subsequent ransom payments.

In the wake of Van der Stap’s arrest, underground Telegram channels allegedly managed by Rey became hotbeds of internal conflict. Community members openly ridiculed Rey after he capitulated to pressure, backed down from his public threats against the FBI and Cl0p, and watched as the ShinyHunters darknet portal abruptly went offline following an ultimatum from law enforcement.

Critics within the cybercrime underground accused Rey of commercializing a defunct brand to extract quick profits. Commentators alleged that he acquired legacy PGP keys and repurposed forum infrastructure to establish imitation websites and communication channels, using the ShinyHunters moniker to extort businesses before attempting to liquidate the stolen data or sell the forum assets.

A specialized tracking channel on Telegram known as "The Battle" dedicated weeks to doxing and criticizing Rey and his associates. The administrators of the channel detailed the scope of his operations, writing that Rey’s decision to impersonate a dismantled hacking collective ultimately led to his downfall. According to community estimates, the network associated with Rey allegedly generated substantial financial damage while negotiating extortion deals on behalf of various affiliate circles.

The group’s operational motivations were further highlighted in an interview with The Register, where ShinyHunters representatives claimed their cyberattack against the FBI was launched in direct retaliation to an advisory bulletin published in May. The FBI’s warning had cautioned organizations against paying ransoms and detailed aggressive harassment tactics employed by the group, including threatening phone calls, text messages, and swatting incidents.

While the hackers asserted that breaching federal infrastructure served as a technical demonstration to counter public warnings, underground leaders privately conceded that law enforcement advisories severely damaged their ability to convince corporate victims to capitulate to extortion demands, rendering the cyberattacks an increasingly desperate public relations exercise.