A teenager from Amman, Jordan, suspected of leading the prolific data theft and extortion syndicate known as ShinyHunters, has been detained and is reportedly cooperating with the Federal Bureau of Investigation to help identify other members of the hacking collective.
According to information obtained by KrebsOnSecurity, the suspect—who operates under the online hacker handle “Rey”—was taken into custody just as ShinyHunters was actively engaged in extorting a business unit recently divested by global aerospace giant Boeing. In a striking twist of geographical coincidence, Boeing manufactures the aircraft fleet utilized by Royal Jordanian Airlines, the employer of Rey’s father.
On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been detained by Jordanian authorities and was actively cooperating with federal investigators from the FBI. KrebsOnSecurity previously identified Rey as Khader in a November 2025 profile, during which the young man openly admitted to collaborating with multiple ransomware operations.
Rey’s name surfaced again in a late September exclusive detailing the Dutch police arrest of 24-year-old convicted cybercriminal Pepijn van der Stap, who is suspected of assisting in data thefts and extortions orchestrated by ShinyHunters. Reports noted that immediately following the Dutchman’s dramatic arrest on the evening of September 15, Rey seized control of the ShinyHunters brand and publicly boasted about stealing highly sensitive data from the FBI while simultaneously attempting to extort the rival Cl0p ransomware group.
Rey aggressively taunted both federal law enforcement and the Cl0p syndicate by publishing memes on his long-standing Twitter/X account. At the same time, he incorporated images of the avatar used by Van der Stap’s former hacker alias, “Umbreon,” in an apparent false-flag operation designed to pin the blame for both high-profile hacks squarely on the Dutchman.
Security reports indicate that ShinyHunters gained unauthorized access to the FBI’s recruitment portal and various other corporate victim networks by exploiting a severe vulnerability, tracked as CVE-2026-35273, residing within Oracle’s PeopleSoft. PeopleSoft is a widely utilized software-as-a-service platform leveraged by corporations globally to manage human resources, recruitment, benefits, and payroll infrastructure.
Oracle rapidly released a security patch after ShinyHunters began weaponizing the vulnerability as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant issued specialized web application firewall rules designed to protect organizations that were unable to apply the official software update immediately.
While ShinyHunters initially claimed in communications with BleepingComputer in June that their primary objective was breaching the FBI’s internal PeopleSoft database—an attempt they admitted was ultimately unsuccessful—the group subsequently changed tactics. In recent weeks, the hackers bypassed Mandiant’s defensive firewall rules by utilizing a well-known URL-encoding trick.
A comprehensive threat intelligence report released by Mandiant and the Google Threat Intelligence Group confirmed that ShinyHunters mass-exploited the PeopleSoft vulnerability to exfiltrate proprietary data from dozens of organizations spanning higher education, technology, healthcare, agriculture, transportation, and government sectors. Subsequent reporting by Reuters revealed that the FBI removed an Accenture contractor over failures to patch the compromised FBI recruitment website. That breach exposed sensitive files concerning more than 5,000 FBI personnel, detailing individual specializations, unit assignments, and confidential medical and psychiatric records.
‘Rey’ Means King, as in Royal
Sources close to the ongoing international investigation revealed that a digital aviation and navigation unit divested by Boeing was among the primary targets being extorted by ShinyHunters when Jordanian authorities apprehended Rey. The investigation into the hacking collective gained considerable urgency following the attempted extortion of this former Boeing subsidiary, largely due to concerns that the stolen data posed significant operational safety and security risks.
In a statement provided to KrebsOnSecurity, Boeing acknowledged the extortion attempts directed at data associated with Jeppesen ForeFlight, a subsidiary that Boeing sold in November 2025 to private equity firm Thoma Bravo for $10.55 billion.
“We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight,” a Boeing spokesperson stated. “Estamos actively reviewing the matter with the Jeppesen ForeFlight team.”
Representatives for Jeppesen ForeFlight issued a counter-statement emphasizing that their systems remained uncompromised. “Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products,” a company spokesperson said.
Rey’s alleged involvement in targeting the former Boeing division bears notable scrutiny given evidence that his father is employed by Royal Jordanian Airlines. The airline is majority-controlled by the Jordanian government and operates its long-haul international routes using commercial Boeing aircraft. Although Rey claimed on Telegram in early 2025 that his father worked as an airline pilot, that specific detail could not be independently verified.
However, forensic analysis of the Khader family’s shared computer—which had been compromised by password-stealing malware—revealed data showing that Rey’s father utilized identical credentials to log into multiple employee portals for Royal Jordanian Airlines.
Royal Jordanian Airlines has not responded to inquiries for comment. Ahead of the publication of prior investigative reports, inquiries were sent to Rey’s father to apprise him of his son’s alleged illicit activities. Neither of the Khaders responded. Within hours of those notifications, however, Rey began systematically scrubbing his social media footprint, deleting the Twitter/X accounts he previously used to taunt federal investigators, ransomware operators, and corporate victims.
Despite the purge of his mainstream social media profiles, Rey’s technical blog hosted on GitHub remained active. The blog features a detailed investigation published in March 2026 that successfully doxxed two Russian men identified as the core developers and operational masterminds behind the Cl0p ransomware enterprise.
Murder-for-Hire Allegations Surface in the Netherlands
Meanwhile, Dutch media outlets reported explosive new allegations regarding Pepijn van der Stap, whose narrative of personal rehabilitation following a previous cybercrime conviction had been heavily covered in technology news circles. The Dutch daily publication RTL reported that investigators suspect Van der Stap attempted to orchestrate at least two murders. According to the reports, the targeted attacks were allegedly planned to take place abroad, and investigators have uncovered indications that Van der Stap issued the direct orders for them.
Van der Stap had recently been released from prison after serving the majority of a four-year sentence for data theft and extortion schemes that prosecutors estimated generated between 1.5 million and 2.7 million euros. In an interview, Van der Stap described his post-prison employment as an “offensive security lead” at Dutch cybersecurity firm Neo Security, claiming his duties involved probing client networks for security flaws.
Neo Security owner Benjamin Korper told Reuters that he hired an independent third-party firm to investigate whether Van der Stap had compromised Neo Security or its clients. Investigators reportedly found no evidence that Van der Stap acted maliciously against his employer or its client base. Korper noted that Dutch forensic police units visited his office on the night of September 15, coinciding with the dramatic raid that led to Van der Stap’s arrest.
Prior to his initial 2023 arrest, Van der Stap worked as a software engineer at Amsterdam-based cybersecurity startup Hadrian and volunteered with the Dutch Institute for Vulnerability Disclosure, all while allegedly conducting extortion operations against major organizations. When questioned about how the public or victims could trust a self-described reformed cybercriminal, Van der Stap maintained that his remediation work spoke for itself.
“You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced,” Van der Stap said. “I’m doing what I can to repay victims, and that’s all I can do. If someone doesn’t want to believe me, then that’s on them.”
Franchising and Burning a Brand
Cybercriminals operating under the ShinyHunters banner have been linked to dozens of major data breaches resulting in the theft of billions of records, with activity tracing back to at least 2019. Security experts emphasize, however, that the individuals currently wielding the ShinyHunters moniker are distinct from the group’s original core members, most of whom are French nationals previously arrested or imprisoned for cybercrime offenses.
Analysts characterize modern ShinyHunters operations as a franchise model akin to the Dread Pirate Roberts persona from popular culture, where operational succession occurs through arrests rather than death, allowing multiple individuals to adopt the brand simultaneously. Sources indicate federal investigators are currently focusing on a network of freelance cybercriminals and affiliates who supply stolen software credentials in exchange for a percentage of subsequent extortion payouts.
Following Van der Stap’s arrest, chat logs within a Telegram channel allegedly operated by Rey revealed widespread friction within underground communities. Participants mocked the teenage hacker after he retreated from public threats directed at the FBI and Cl0p, particularly as the primary ShinyHunters darknet portal abruptly went offline. Critics accused Rey of commercializing the defunct hacking group’s name for personal financial gain.
“He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke,” one community member noted.
A competing Telegram channel designated “The Battle” has continuously doxxed and harassed Rey and other alleged associates, gaining significant readership within underground forums. Administrators of that channel asserted that Rey made a critical tactical error by co-opting a burned criminal brand.
“Rey made a serious mistake when he started pretending to be a member of ShinyHunters,” the administrators wrote on Telegram. “That group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes.”
In prior statements to industry press, representatives for ShinyHunters claimed their attacks against federal infrastructure were executed to counter public safety advisories issued by law enforcement that discouraged extortion payments. While the group acknowledged that federal warnings materially impacted their ability to secure ransoms, the arrests of key affiliates in Amman and Amsterdam suggest law enforcement agencies are steadily dismantling the decentralized network operating beneath the infamous banner.
