A teenager residing in Amman, Jordan, who is strongly suspected of operating as a key leader for the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to help identify other members of the hacking collective.

According to intelligence gathered by KrebsOnSecurity, the suspect—who operates under the online handle “Rey”—was taken into custody just as ShinyHunters was actively engaged in extorting a business unit recently divested by global aerospace giant Boeing. Intriguingly, the suspect’s father is employed by Royal Jordanian Airlines, a carrier that operates a fleet primarily composed of Boeing commercial aircraft, adding a striking familial and geographic layer to an already complex international cybercrime investigation.

The Capture of "Rey" and Global Fallout

On October 3, Reuters cited three confidential sources confirming that a suspected ShinyHunters operative in Amman named Saif Al-din Khader had been detained by Jordanian law enforcement and was actively cooperating with federal U.S. investigators. KrebsOnSecurity had previously identified Rey as Khader in a detailed November 2025 investigative profile, in which the young man admitted to collaborating with multiple ransomware operations.

Rey returned to the cybersecurity spotlight in a late September exclusive detailing the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap. Dutch authorities apprehended Van der Stap on suspicion of facilitating data thefts and extortion schemes for ShinyHunters. Immediately following the Dutchman’s dramatic arrest on the evening of September 15, Rey seized control of the ShinyHunters brand online. He publicly boasted about pilfering highly sensitive data from the FBI and attempting to extort the notorious ransomware syndicate known as Cl0p.

In a brazen display of digital taunting, Rey mocked both the FBI and Cl0p by publishing custom memes on his long-standing Twitter/X account. At the same time, he strategically embedded images of the avatar utilized by Van der Stap’s former hacker alias, “Umbreon,” in a calculated attempt to frame the Dutch national for the high-profile intrusions.

The security breaches orchestrated by ShinyHunters relied heavily on exploiting a critical vulnerability (tracked as CVE-2026-35273) within PeopleSoft, a widely deployed enterprise software platform from tech giant Oracle used across industries for human resources, payroll, and recruitment management. Oracle swiftly released a security update after ShinyHunters began weaponizing the zero-day flaw in June. Simultaneously, cybersecurity firm Mandiant issued emergency web application firewall (WAF) rules for organizations unable to apply the patch immediately.

While initial attempts by ShinyHunters in June targeted the FBI’s own PeopleSoft database without success, the group later bypassed Mandiant’s defensive safeguards using well-documented URL-encoding tricks. By late September, a joint threat intelligence report from Mandiant and the Google Threat Intelligence Group confirmed that the syndicate had mass-exploited the PeopleSoft vulnerability, compromising dozens of corporate and governmental networks spanning transportation, higher education, healthcare, technology, and agriculture.

Further compounding the fallout, Reuters reported that the FBI removed an Accenture contractor over failures to patch the compromised FBI recruitment portal. The breach exposed sensitive personnel records belonging to more than 5,000 bureau employees, including specialized unit assignments alongside confidential medical and psychiatric histories.

“Rey” Means King, as in Royal

Investigators familiar with the case revealed that a digital navigation and aviation unit recently divested by Boeing was among the primary targets being extorted by ShinyHunters when Jordanian authorities moved in to arrest Khader. The involvement of the former Boeing division introduced immediate operational safety and security concerns, accelerating the FBI’s investigative timeline.

In a statement provided to KrebsOnSecurity, Boeing acknowledged the extortion attempts tied to Jeppesen ForeFlight, a subsidiary that Boeing sold to private equity firm Thoma Bravo for $10.55 billion in November 2025.

“We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight,” a Boeing spokesperson stated, adding that the corporation is actively reviewing the situation alongside the subsidiary’s security team. Representatives for Jeppesen ForeFlight maintained that their internal investigation found no operational disruption or product impact.

Rey’s reported connection to the Boeing-related extortion plot carries additional weight given his family ties. Evidence retrieved from a password-stealing malware infection on a shared family computer indicated that Rey’s father utilized consistent credentials across multiple employee portals for Royal Jordanian Airlines, a government-backed carrier operating long-haul Boeing fleets. Although early 2025 Telegram posts by Rey claimed his father was an airline pilot, those assertions could not be independently verified.

Following press inquiries sent to the Khader family prior to a late September report, Rey systematically deleted his social media profiles—including the Twitter/X handle used to taunt federal investigators and ransomware syndicates. However, a public cybersecurity blog maintained by Rey on GitHub remained active, featuring a detailed March 2026 post doxing two Russian individuals alleged to be the core operators and developers behind the Cl0p ransomware operation.

Murder-for-Hire Allegations Surface in the Netherlands

Meanwhile, Dutch media outlets brought to light severe criminal allegations against Pepijn van der Stap, whose narrative of personal and professional rehabilitation had previously gained traction in tech circles. According to a report by Dutch broadcaster RTL, investigators suspect Van der Stap of attempting to commission at least two murders to be carried out abroad.

Van der Stap had recently completed a prison sentence for data theft and extortion activities that prosecutors estimated yielded between 1.5 million and 2.7 million euros. Prior to his September 15 arrest—which involved a tactical police raid utilizing flash-bang grenades—Van der Stap claimed to be working as an "offensive security lead" for Amsterdam-based cyber defense firm Neo Security, conducting authorized vulnerability assessments for clients.

Neo Security owner Benjamin Korper confirmed that an independent forensic firm was retained to investigate whether Van der Stap compromised internal systems or client networks, though no unauthorized activity has been identified to date. Before his initial 2023 conviction, Van der Stap worked as a software engineer for local cybersecurity startup Hadrian and volunteered with the Dutch Institute for Vulnerability Disclosure, operating illicitly while embedded within legitimate security communities.

Franchising and Burning a Brand

Cybersecurity experts emphasize that the modern incarnation of ShinyHunters bears little resemblance to the original collective of French nationals responsible for billions of compromised records in earlier campaigns dating back to 2019. Much like the mythical "Dread Pirate Roberts" persona, the ShinyHunters identity has transformed into a decentralized franchise where successive operators inherit the moniker following the arrest or removal of their predecessors.

Federal investigators are concentrating on a network of freelance cybercriminals and affiliates who supply stolen SaaS credentials in exchange for a percentage of subsequent ransom payouts. Following Van der Stap’s arrest and the sudden offline status of the group’s darknet portal, Telegram channels associated with Rey became arenas for intense criticism. Peers within the cybercrime underground accused the teenager of cheapening the syndicate’s reputation by co-opting historical forum keys and executing amateurish extortion schemes.

Administrators of a Telegram monitoring channel dedicated to tracking the group asserted that Rey caused substantial financial and reputational friction while acting as an intermediary for splinter cells over the preceding months.

The pressure intensified following a public advisory published by the FBI in May 2026, which cautioned victims against yielding to ShinyHunters’ aggressive harassment tactics—ranging from threatening communications to physical swatting incidents. In interviews with industry press, members of the hacking collective admitted that their subsequent attacks on federal web infrastructure served primarily as a public relations counter-offensive designed to reassert their technical credibility and mitigate the dampening effect of law enforcement warnings on ransom collections.