A teenager from Amman, Jordan, suspected of leading the prolific and destructive data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to identify other members of the hacking collective.
According to intelligence gathered by KrebsOnSecurity, the suspect—who operates online under the hacker handle “Rey”—was taken into custody just as ShinyHunters was in the middle of executing an extortion campaign against a business unit recently divested by global aerospace giant Boeing. In a striking twist of geopolitical irony, this targeted Boeing affiliate manufactures the fleet of planes utilized by the employer of Rey’s own father: Royal Jordanian Airlines.
The international dragnet tightening around the young cybercriminal follows months of escalating digital turf wars, high-profile corporate compromises, and brazen attacks on federal law enforcement infrastructure.
The Arrest and Identification of "Rey"
On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been detained by Jordanian law enforcement and was actively cooperating with federal investigators from the United States Federal Bureau of Investigation.
KrebsOnSecurity had previously identified Rey as Khader in a November 2025 profile, during which the young man openly admitted to collaborating with multiple ransomware operations. Rey’s name resurfaced in late September in connection with an exclusive report detailing the Dutch police’s arrest of 24-year-old convicted cybercriminal Pepijn van der Stap, who was suspected of aiding ShinyHunters in data thefts and extortions.
According to investigative findings, immediately following Van der Stap’s dramatic arrest on the evening of September 15, Rey seized control of the ShinyHunters brand. He wasted no time boasting publicly about breaching highly sensitive data belonging to the FBI and launching extortion threats against the notorious ransomware syndicate Cl0p.
Utilizing his longtime account on Twitter/X, Rey taunted both federal law enforcement and the Cl0p gang with a series of satirical memes. In an apparent attempt to frame the newly arrested Dutchman for the fresh wave of hacks, Rey embedded images of the avatar used by Van der Stap’s former hacker alias, “Umbreon,” directly into his taunting posts.
The Oracle PeopleSoft Vulnerability and FBI Breach
The recent spike in ShinyHunters activity traces back to a critical security flaw cataloged as CVE-2026-35273. The group gained unauthorized access to the FBI’s recruitment systems and dozens of other corporate and government networks by exploiting vulnerabilities within PeopleSoft, a widely used software-as-a-service (SaaS) platform from Oracle designed for managing corporate human resources, recruitment, benefits, and payroll.
Oracle moved quickly to issue a security update after ShinyHunters began weaponizing the vulnerability as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant released web application firewall (WAF) rules to protect organizations unable to immediately patch their servers.
While the hackers initially informed technology news outlets that their primary objective was breaching the FBI’s own PeopleSoft database—an attempt they claimed was ultimately unsuccessful—they later circumvented Mandiant’s defensive measures. Using a well-known URL-encoding bypass trick, the threat actors successfully penetrated systems across higher education, technology, healthcare, agriculture, transportation, and government sectors.
A comprehensive threat intelligence report released on September 25 by Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability to siphon confidential data from a wide array of industries. The fallout extended directly into federal contracting oversight; Reuters reported that the FBI removed an Accenture contractor following revelations that a failure to apply critical security patches left the bureau’s recruitment portal exposed. The resulting breach compromised sensitive records belonging to more than 5,000 FBI personnel, including individual unit specializations, medical files, and psychiatric records.
"Rey" Means King, as in Royal
Investigators familiar with the ongoing ShinyHunters probe revealed that a digital aviation and navigation unit recently divested by Boeing was among the primary targets being extorted by the group at the exact moment Rey was apprehended in Amman. The inclusion of the aerospace subsidiary injected a new level of urgency into the FBI’s investigation, as stolen proprietary information from the aviation sector presented severe operational safety and security implications.
In a statement provided to security researchers, Boeing acknowledged the extortion attempts, confirming that the incident involved data stolen from Jeppesen ForeFlight. Boeing had previously sold the specialized subsidiary to private equity firm Thoma Bravo in November 2025 for $10.55 billion. While Boeing officials noted they were actively reviewing the situation alongside the Jeppesen ForeFlight team, a spokesperson for the subsidiary maintained that ongoing investigations revealed no actual operational or product impact.
Rey’s alleged role in targeting the former Boeing unit carries deep personal irony. Strong evidence indicates his father is employed by Royal Jordanian Airlines, a carrier predominantly controlled by the Jordanian government that operates its long-haul routes using passenger aircraft built by Boeing. Although Rey claimed on Telegram in early 2025 that his father worked as an airline pilot, that specific detail could not be independently verified.
Digital forensics from an earlier profile of Rey revealed that his household’s shared computer was previously compromised by password-stealing malware. Logs extracted from that infection demonstrated that Rey’s father utilized identical credentials to log into various administrative portals for Royal Jordanian Airlines employees.
Requests for comment sent to Royal Jordanian Airlines and Rey’s family went unanswered. However, within hours of receiving a follow-up inquiry regarding his son’s activities, Rey began aggressively scrubbing his digital footprint, deleting multiple social media profiles—including the Twitter/X account used to mock the FBI and Cl0p.
Despite the social media purge, Rey’s technical blog hosted on GitHub remained online. A lengthy post published in March 2026 featured a deep-dive investigation that successfully doxxed two Russian men alleged to be the core developers and operators behind the Cl0p ransomware operation.
Explosive Allegations in the Netherlands
Meanwhile, the investigation surrounding Pepijn van der Stap took a far darker turn in the Netherlands. Dutch daily newspaper RTL reported that local investigators suspect Van der Stap attempted to orchestrate at least two murders to be carried out abroad, pointing to indications that the former hacker gave direct orders for the attacks.
Van der Stap had recently completed the greater part of a four-year prison sentence for prior data theft and extortion offenses that prosecutors estimated netted between 1.5 million and 2.7 million euros. Following his release, he successfully rehabilitated his public image, presenting himself as a reformed cybersecurity professional and accepting a position as an "offensive security lead" at Dutch firm Neo Security, where he claimed his daily work involved testing client defenses.
Neo Security’s owner, Benjamin Korper, told reporters that the company hired an independent firm to audit Van der Stap’s activities, confirming that no evidence had emerged suggesting the employee had compromised his employer or its clients. Nevertheless, Dutch forensic units raided Van der Stap’s residence on September 15 using flash-bang grenades, cutting short his brief tenure in legitimate corporate security.
Prior to his initial 2023 arrest, Van der Stap had maintained a double life, working as a software engineer for Amsterdam-based cybersecurity startup Hadrian and volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD) while simultaneously infiltrating and extorting major international corporations. When interviewed prior to his second arrest about how he could justify his deception, Van der Stap maintained that his subsequent remedial work was the only restitution he could offer critics.
Franchising Cybercrime and Burning a Brand
While cybercriminals operating under the ShinyHunters banner have been linked to dozens of massive data breaches accounting for billions of stolen records since at least 2019, modern threat intelligence indicates that current operators bear little relation to the group’s original French core members, many of whom have already been arrested and prosecuted.
Security experts describe modern iterations of ShinyHunters as a decentralized franchise model. Similar to the fictional "Dread Pirate Roberts" persona, the brand survives through succession by arrest, allowing multiple independent actors to adopt the moniker simultaneously. Federal investigators are increasingly focusing on a network of freelance cybercriminals who feed stolen corporate SaaS credentials to affiliate groups in exchange for a percentage of subsequent ransom payments.
In the wake of Van der Stap’s arrest, chat servers on Telegram previously managed by Rey erupted in internal conflict. Fellow cybercriminals mocked the teenage hacker for abruptly deleting his accounts, backing down from threats against federal agencies, and watching helplessly as the ShinyHunters darknet portal was forced offline following an FBI ultimatum. Commentators accused Rey of purchasing historical PGP keys and forum credentials simply to larp as the famous hacking collective for financial gain.
A competing Telegram channel dedicated to exposing modern threat actors asserted that Rey caused over $200 million in cumulative damages by leveraging the ShinyHunters name to negotiate extortion settlements for various cybercriminal cliques, taking a cut of up to thirty percent.
In a defiant interview with technology publication The Register, representatives for ShinyHunters claimed their decision to target the FBI was a calculated public relations response. The hackers argued that a flash notice published by the FBI in May 2026—which warned organizations against paying ransoms and detailed the group’s harassment tactics, including threatening phone calls and swatting—unfairly damaged their business prospects and mischaracterized their operations. By demonstrating their ability to breach federal recruitment databases, the hackers sought to counter the bureau’s warnings and reassert their viability in the illicit digital extortion marketplace.
