A teenager from Amman, Jordan, suspected of leading the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to help identify other members of the hacking collective.
According to intelligence gathered by KrebsOnSecurity, the suspect—who operates online under the hacker handle “Rey”—was taken into custody just as the ShinyHunters network was actively attempting to extort a business unit recently divested by global aerospace giant Boeing. In a striking geopolitical irony, the employer of Rey’s father is Royal Jordanian Airlines, a carrier that operates a fleet consisting primarily of Boeing passenger aircraft.
On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been detained by Jordanian authorities and was actively assisting the FBI. KrebsOnSecurity previously identified Rey as Khader in a November 2025 investigative profile, in which the young man openly admitted to collaborating with multiple ransomware operations.
Rey’s activities made headlines once again in a September 28 exclusive detailing the Dutch police arrest of 24-year-old convicted cybercriminal Pepijn van der Stap. Authorities suspect Van der Stap aided in data thefts and extortions orchestrated by ShinyHunters. Immediately following the Dutchman’s arrest on the evening of September 15, Rey assumed direct control over the ShinyHunters brand, publicly boasting about stealing highly sensitive data from the FBI and attempting to extort the notorious ransomware group Cl0p.
Using his long-standing account on Twitter/X, Rey taunted both federal law enforcement and Cl0p operatives with custom memes. He deliberately embedded images of the avatar associated with Van der Stap’s former hacker alias, “Umbreon,” in an apparent attempt to frame the Dutch national for the high-profile security breaches.
Security researchers note that ShinyHunters breached the FBI recruitment portal and other corporate victims by exploiting a critical zero-day vulnerability tracked as CVE-2026-35273. The flaw targeted Oracle PeopleSoft, a widely deployed software-as-a-service platform used across industries for human resources, payroll, and benefits management. Oracle quickly patched the vulnerability after ShinyHunters began mass exploitation in June, while firms like Mandiant issued emergency web application firewall (WAF) rules for organizations unable to apply patches immediately.
Although ShinyHunters initially told BleepingComputer in June that their primary objective was to breach the FBI’s proprietary PeopleSoft database—an attempt they claimed was ultimately unsuccessful—the group later bypassed Mandiant’s defensive measures using standard URL-encoding tricks.
A threat intelligence report released on September 25 by Mandiant and the Google Threat Intelligence Group confirmed that the syndicate leveraged the PeopleSoft vulnerability to harvest data from dozens of organizations across higher education, technology, healthcare, agriculture, transportation, and government sectors. Subsequent reporting by Reuters on October 5 revealed that the FBI removed an Accenture contractor over failures to patch the targeted recruitment portal, a breach that exposed personal and sensitive records belonging to over 5,000 FBI personnel, including specialized units and medical files.
“Rey” Means King, as in Royal
Sources familiar with the ongoing international investigation disclosed that a digital navigation and aviation unit recently divested by Boeing was in the crosshairs of ShinyHunters’ extortion campaign when Rey was apprehended in Amman. The attempted extortion of the former Boeing asset added intense urgency to the FBI’s investigation, particularly because the stolen data allegedly posed genuine operational safety and security risks.
In a statement provided to KrebsOnSecurity, Boeing acknowledged the extortion threats, confirming that the incident involved data originating from Jeppesen ForeFlight, a subsidiary that Boeing sold in November 2025 to private equity firm Thoma Bravo for $10.55 billion.
“We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight,” a Boeing spokesperson stated. “We are actively reviewing the matter with the Jeppesen ForeFlight team.”
Representatives for Jeppesen ForeFlight maintained that their internal systems remained secure. In a written statement, the company noted that based on ongoing forensic investigations and a proactive security posture, there had been no negative impact on day-to-day operations or commercial products.
Rey’s alleged involvement in the Boeing unit extortion scheme draws additional scrutiny given that his father is widely believed to be employed by Royal Jordanian Airlines, a carrier majority-controlled by the Jordanian government. While Rey claimed on Telegram in early 2025 that his father worked as an airline pilot, those assertions could not be independently verified. However, a November 2025 profile by KrebsOnSecurity revealed that a family computer infected with password-stealing malware contained logs showing Rey’s father using identical credentials across several internal portals utilized by Royal Jordanian staff.
Royal Jordanian Airlines did not respond to requests for comment. Shortly before publishing its late September report, KrebsOnSecurity reached out to Rey’s father to apprise him of his son’s alleged cybercriminal activities. Neither of the Khaders replied; however, within hours of that notification, Rey began scrubbing his footprint by deleting his social media profiles, including the Twitter/X handle used to taunt federal investigators and the Cl0p syndicate.
Despite wiping his mainstream social media accounts, Rey left behind a cybersecurity blog hosted on GitHub. In March 2026, the blog published a detailed investigative post that successfully doxxed two Russian nationals allegedly serving as the core developers and masterminds behind the Cl0p ransomware operation.
Murder-For-Hire Allegations
Meanwhile, legal proceedings in the Netherlands revealed explosive accusations against Pepijn van der Stap, whose narrative of personal rehabilitation and transition to defensive security had recently gained traction in tech circles. According to a September 29 report by Dutch broadcaster RTL, investigators suspect Van der Stap attempted to orchestrate at least two murders overseas, allegedly issuing direct orders for the attacks.
Van der Stap had recently completed the majority of a four-year prison sentence for data theft and extortion schemes that prosecutors estimated generated between 1.5 million and 2.7 million euros. During a September 9 interview, Van der Stap claimed he had pivoted to a legitimate career as an "offensive security lead" at Neo Security, a Dutch cybersecurity firm where he purportedly tested client network defenses.
Neo Security owner Benjamin Korper told Reuters that the firm retained an external auditor to determine whether Van der Stap had compromised internal systems or client networks, though initial reviews found no evidence of malicious activity on behalf of the company. Korper added that Dutch forensic teams visited his offices on September 15 during a dramatic police raid on Van der Stap’s residence that reportedly involved flash-bang grenades.
Before his initial 2023 arrest, Van der Stap worked as a software engineer at Amsterdam-based startup Hadrian while volunteering with the Dutch Institute for Vulnerability Disclosure, operating illicitly against high-profile organizations behind the scenes. When questioned about how the public could trust a self-described reformed hacker who maintained prolonged deceptions, Van der Stap argued that his remedial efforts defined his path forward.
“You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced,” Van der Stap said. “I’m doing what I can to repay victims, and that’s all I can do. If someone doesn’t want to believe me, then that’s on them.”
Franchising and Burning a Brand
Cybercriminals operating under the ShinyHunters banner have been linked to dozens of major data breaches resulting in billions of compromised records dating back to 2019. Security experts point out, however, that current operators have little connection to the group’s original French core members, many of whom have already faced arrest and prosecution.
Instead, ShinyHunters has evolved into a criminal franchise—mirroring the concept of the fictional "Dread Pirate Roberts," where leadership passes down through arrests rather than death, allowing multiple individuals to adopt the mantle concurrently. Investigators believe the FBI is currently prioritizing a network of freelance cybercriminals who feed stolen corporate SaaS credentials to affiliates in exchange for a percentage of ransom payouts.
Following Van der Stap’s arrest, a Telegram chat server reportedly managed by Rey erupted in internal community backlash. Participants mocked the teenager after he backed down from public threats against federal agencies and the Cl0p group, an embarrassment compounded when the ShinyHunters dark web portal abruptly went offline.
Commentators accused Rey of purchasing historical forum PGP keys and co-opting the defunct ShinyHunters brand to build fraudulent mimic websites and Telegram channels. They alleged he used these fake personas to pressure corporate victims into paying ransoms before attempting to cash out or resell the infrastructure.
A rival Telegram monitoring channel, "The Battle," spent weeks tracking and doxxing Rey and his associates, characterizing the teenager as an inexperienced opportunist riding the coattails of a notorious brand.
“Rey (Saif Al-Din Khader) made a serious mistake when he started pretending to be a member of ShinyHunters,” channel administrators wrote. “That group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes.”
In an interview with The Register, representatives for the hacker collective claimed their assault on the FBI was designed to counter a public advisory issued by the agency on May 15, which warned organizations against negotiating with the group. The FBI’s flash notice detailed aggressive harassment tactics employed by ShinyHunters affiliates, including harassing phone calls, text messages, swatting incidents, and false threats regarding the publication of fabricated compromising media.
While ShinyHunters operatives told reporters that the FBI breach demonstrated their technical capabilities and served as a marketing campaign to counter law enforcement warnings, security researchers maintain that law enforcement pressure and internal fracturing have severely diminished the group’s operational viability.
