A teenager based in Amman, Jordan, suspected of operating as a key leader of the prolific data theft and extortion collective known as ShinyHunters, has been taken into custody. According to reports, the suspect is currently cooperating with the Federal Bureau of Investigation (FBI) to help authorities identify and track down other active members of the notorious hacking syndicate.
According to investigative findings by KrebsOnSecurity, the detained suspect utilizes the online hacker handle “Rey.” Law enforcement and security researchers have identified him as Saif Al-din Khader. His detention occurred precisely as the ShinyHunters collective was in the middle of executing an extortion campaign targeting a business unit recently divested by global aerospace giant Boeing. In a striking geopolitical coincidence, the employer of Rey’s father is Royal Jordanian Airlines, an airline whose long-haul passenger fleet relies on aircraft manufactured by Boeing.
The international implications of the arrest began to unfold publicly when Reuters cited three confidential sources confirming that a suspected ShinyHunters member named Saif Al-din Khader had been detained by Jordanian authorities and was assisting the FBI. This development followed a detailed profile published in November 2025 which first unmasked Rey and documented his admissions regarding collaboration with multiple ransomware groups.
Rey’s name resurfaced prominently in a late September exclusive covering the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap. Dutch police apprehended Van der Stap on suspicion of providing crucial aid in data thefts and extortions orchestrated by ShinyHunters. Investigations revealed that immediately following the dramatic raid on Van der Stap’s residence on the evening of September 15, Rey seized control of the ShinyHunters brand online. He quickly began publicly boasting about breaching highly sensitive systems belonging to the FBI and extorting the notorious Cl0p ransomware group.
To confound investigators and shift blame, Rey taunted both the FBI and Cl0p by publishing custom memes on his long-standing Twitter/X account. These posts incorporated images of the avatar utilized by Van der Stap’s former hacker alias, “Umbreon,” in an explicit effort to frame the Dutch national for the high-profile cyberattacks.
Security researchers from Mandiant and the Google Threat Intelligence Group revealed that ShinyHunters successfully infiltrated the FBI’s recruitment portal and other corporate networks by exploiting a critical zero-day vulnerability, tracked as CVE-2026-35273. The flaw affected PeopleSoft, a widely utilized software-as-a-service platform owned by tech conglomerate Oracle that handles human resources, payroll, and corporate hiring processes. Although Oracle moved quickly to issue a security patch after the group began mass-exploiting the flaw in June, and Mandiant released web application firewall rules for unpatched organizations, the hackers later bypassed these defenses using a well-known URL-encoding trick.
The resulting data breaches proved severely damaging. Reuters reported that the FBI removed an Accenture contractor over failures to properly patch the compromised recruitment portal, which exposed sensitive personal and professional data concerning more than 5,000 FBI personnel, including psychiatric records, medical files, and specific unit specializations.
“Rey” Means King, as in Royal
Sources familiar with the ongoing international investigation confirmed that a digital navigation and aviation unit divested by Boeing was actively being extorted by ShinyHunters at the time of Rey’s apprehension. The inclusion of a former Boeing subsidiary in the extortion scheme lent unprecedented urgency to the FBI’s investigation, given the potential operational safety and security risks associated with the stolen aviation data.
Boeing acknowledged the cyber extortion attempts, clarifying that the incident involved data stolen from Jeppesen ForeFlight, a specialized navigation subsidiary that Boeing sold to private equity firm Thoma Bravo for $10.55 billion. Representatives for Boeing stated that the company is actively reviewing the situation alongside the Jeppesen ForeFlight team, while Jeppesen ForeFlight representatives maintained that an internal investigation showed no adverse impacts on their active operations or products.
Rey’s connection to the aviation sector extends directly to his family. Strong evidence indicates that his father works as a pilot for Royal Jordanian Airlines, a carrier largely controlled by the Jordanian government that operates long-haul aircraft built by Boeing. Although initial claims made by Rey on Telegram regarding his father’s profession could not be independently verified at first, subsequent digital forensics revealed critical security lapses. A password-stealing malware infection on the family’s shared computer captured credentials that Rey’s father used to access multiple internal online portals for Royal Jordanian Airlines employees.
Despite outreach from journalists, neither Rey nor his father responded to requests for comment. However, shortly after investigative inquiries were sent to his father, Rey initiated a massive digital purge, deleting numerous social media profiles—including the Twitter/X account used to mock the FBI and Cl0p. Nevertheless, his personal cybersecurity blog hosted on GitHub remained online, featuring an extensive investigative post from March 2026 that doxxed two Russian nationals allegedly operating as the core masterminds behind the Cl0p ransomware operation.
Murder for Hire Allegations
While investigators piece together the digital footprint of the ShinyHunters network, Dutch media reported astonishing and violent allegations directed at Pepijn van der Stap. Despite his public rebranding as a reformed hacker and his employment as an "offensive security lead" at Amsterdam-based Neo Security, Dutch daily RTL reported that local investigators suspect Van der Stap attempted to orchestrate at least two murders abroad.
Van der Stap had recently completed the majority of a four-year prison sentence stemming from previous data theft and extortion convictions that prosecutors estimated netted between 1.5 million and 2.7 million euros. Following his September release and subsequent hiring by Neo Security, Dutch law enforcement executed a high-profile raid involving flash-bang grenades on September 15, taking him back into custody. Neo Security owner Benjamin Korper noted that while an independent firm found no evidence that Van der Stap compromised his current employer or clients, the unfolding criminal allegations have cast a heavy shadow over claims of rehabilitation.
Prior to his initial 2023 arrest, Van der Stap worked as a software engineer at a cybersecurity startup while simultaneously volunteering with the Dutch Institute for Vulnerability Disclosure, all while participating in corporate extortions. When questioned previously about how anyone could trust a self-described reformed criminal, Van der Stap maintained that his remediation efforts and technical work were the only answers he could offer to skeptics.
Franchising and Burning a Brand
Cybersecurity experts emphasize that the individuals operating under the ShinyHunters banner today bear little resemblance to the original French nationals who founded the group and carried out massive data thefts dating back to 2019. Over the years, ShinyHunters has transformed into an informal franchise model—operating similarly to the "Dread Pirate Roberts" persona, where succession occurs through law enforcement arrests rather than natural retirement, allowing multiple splinter actors to operate under the same legendary moniker.
Intelligence gathered from cybercrime chat servers on Telegram revealed intense backlash against Rey following his arrest and the sudden disappearance of the ShinyHunters darknet portal. Rivals and former associates accused the teenage hacker of purchasing old PGP keys and forum credentials simply to larp as ShinyHunters, generating millions in damages while undermining the group’s established criminal brand. According to administrative posts on rival Telegram monitoring channels, Rey allegedly helped several decentralized friend groups negotiate ransom demands in exchange for a 25 to 30 percent cut.
The group’s decision to target the FBI directly stemmed from intense public relations motives. Following a May 2026 flash notice issued by the FBI warning victims against paying ransoms and detailing aggressive tactics—such as harassing phone calls, text messages, and swatting—ShinyHunters claimed their hacks against federal systems were executed explicitly to counter the agency’s narrative and demonstrate their technical capabilities. However, security analysts note that these aggressive marketing ploys ultimately invited unprecedented global law enforcement scrutiny, culminating in the rapid dismantling of the network’s leadership and the cooperation of key figures like Rey with international investigators.
