Suspected ShinyHunters Leader "Rey" Detained in Jordan and Cooperating With the FBI Amid Boeing Extortion Probe

A teenager from Amman, Jordan, suspected of leading the prolific data theft and extortion syndicate known as ShinyHunters, has been detained and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to identify other members of the hacking collective.

According to investigative reporting by KrebsOnSecurity and initial confirmations from Reuters, the suspect—who operates under the hacker handle “Rey”—was taken into custody just as the group was actively attempting to extort a business unit recently divested by global aerospace giant Boeing. Intressantly, the suspect’s father is employed by Royal Jordanian Airlines, a carrier that operates a fleet primarily composed of Boeing aircraft.

On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been detained by Jordanian authorities and was actively assisting the FBI. KrebsOnSecurity had previously identified Rey as Khader in a November 2025 investigative profile, wherein the young man openly admitted to collaborating with multiple ransomware operations.

Rey’s activities were thrust back into the spotlight following an exclusive report regarding the Dutch police’s arrest of 24-year-old convicted cybercriminal Pepijn van der Stap. Van der Stap was apprehended on suspicion of assisting ShinyHunters in carrying out data thefts and high-profile extortions. Immediately following the Dutchman’s arrest on the evening of September 15, Rey assumed control over the ShinyHunters brand online, publicly boasting about breaching the FBI and extorting the infamous ransomware group Cl0p.

Using his long-standing account on Twitter/X, Rey taunted both federal law enforcement and Cl0p operators with various memes. Concurrently, he embedded images of the avatar utilized by Van der Stap’s former hacker alias, “Umbreon,” in what appeared to be an intentional campaign to frame the Dutch national for the fresh wave of high-tech intrusions.

As outlined in previous cybersecurity disclosures, ShinyHunters managed to breach the FBI’s recruitment portal and other corporate victims by exploiting a zero-day vulnerability tracked as CVE-2026-35273. The flaw resided in PeopleSoft, an enterprise software-as-a-service platform owned by Oracle and widely deployed by organizations globally for human resources, payroll, and benefits management. Oracle quickly patched the vulnerability after ShinyHunters began mass-exploiting it in June. Simultaneously, Mandiant issued defensive web application firewall (WAF) rules for organizations unable to apply the security updates immediately.

Although ShinyHunters initially targeted the FBI’s PeopleSoft database in June—with hackers telling BleepingComputer that the initial breach attempts were largely unsuccessful—the group later pivoted. In subsequent weeks, the threat actors bypassed Mandiant’s recommended WAF rules by deploying a well-known URL-encoding trick.

By late September, security researchers at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had successfully weaponized the PeopleSoft vulnerability in a mass-exploitation campaign. The attacks compromised dozens of systems across a diverse array of sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies. Subsequent reporting by Reuters revealed that the FBI removed an Accenture contractor over the firm’s failure to patch the targeted recruitment portal. The breach exposed sensitive records belonging to more than 5,000 FBI personnel, detailing individual units, specializations, and confidential medical and psychiatric records.

“Rey” Means King, as in Royal

Sources familiar with the ongoing international investigation into ShinyHunters confirmed that among the final targets the group was attempting to extort prior to Rey’s apprehension was a digital aviation and navigation unit recently divested by Boeing. The involvement of the young hacker in this specific extortion plot added immediate urgency to the FBI’s investigation, particularly given that the stolen data included sensitive proprietary material carrying potential operational safety and security risks.

In a statement provided to KrebsOnSecurity, Boeing acknowledged the extortion demands made by the threat actors, confirming that the compromised data originated from Jeppesen ForeFlight. Boeing had previously sold the subsidiary in November 2025 to private equity firm Thoma Bravo for $10.55 billion.

"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated, adding that the corporation was actively reviewing the situation alongside the Jeppesen ForeFlight security team. Jeppesen ForeFlight similarly maintained that an internal investigation revealed no adverse impact on its day-to-day operations or commercial products.

Rey’s alleged role in targeting the aviation unit draws added scrutiny due to compelling evidence linking his family to Royal Jordanian Airlines. The airline is majority-owned by the Jordanian government and operates long-haul passenger flights on Boeing aircraft. While Rey claimed on Telegram in early 2025 that his father worked as an airline pilot, those claims could not be independently verified. However, previous technical analyses of malware-compromised family computers revealed that Rey’s father used identical credentials to log into multiple online portals utilized by Royal Jordanian personnel.

Royal Jordanian Airlines has not responded to requests for comment. Following outreach from journalists, Rey systematically deleted his social media presence, including the Twitter/X profile he used to mock law enforcement and rival cyber syndicates. Despite the digital purge, a cybersecurity blog maintained by Rey on GitHub remained online. The repository features an extensive March 2026 post doxing two Russian men alleged to be the core developers and operators behind the Cl0p ransomware platform.

Murder for Hire Allegations

Meanwhile, new legal and investigative developments unfolded in the Netherlands concerning Pepijn van der Stap, whose transition from a convicted cybercriminal to a self-described "reformed hacker" had received considerable media attention. Dutch daily publication RTL reported that local investigators suspect Van der Stap of orchestrating at least two contract murders to be carried out internationally.

Van der Stap had recently been released from prison after serving the majority of a four-year sentence for extortions and data thefts that prosecutors estimated netted between 1.5 million and 2.7 million euros. Prior to his September 15 arrest, Van der Stap interviewed with security journalists, presenting himself as the "offensive security lead" at Neo Security, a Dutch cybersecurity firm where he purportedly tested client network defenses.

Neo Security owner Benjamin Korper told reporters that he engaged an external forensic firm to investigate whether Van der Stap had compromised his company or its clients, though initial reviews found no internal wrongdoing. Korper confirmed that Dutch law enforcement officers executed a dramatic raid on his office on the evening of Van der Stap’s arrest, reportedly deploying flash-bang grenades. Before his initial 2023 conviction, Van der Stap worked as a software engineer at an Amsterdam-based security startup while volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD), even as he covertly hacked corporate networks.

Franchising and Burning a Brand

Security experts note that the individuals currently operating under the ShinyHunters moniker represent a new generation of cybercriminals rather than the original core members, most of whom are French citizens previously arrested and imprisoned for related offenses. Over time, the ShinyHunters identity has effectively transformed into a decentralized franchise. Much like the literary concept of the Dread Pirate Roberts, succession within the group has operated through a cycle of arrests, with multiple independent actors adopting the moniker simultaneously.

Investigators indicate that the FBI is actively pursuing a remaining network of freelance cybercriminals. These affiliates have allegedly supplied the group with stolen credentials to enterprise SaaS platforms in exchange for a percentage of any successful ransom payments extracted from victim organizations.

Following Van der Stap’s arrest, a Telegram chat server allegedly administered by Rey erupted with backlash from community members. Participants criticized the teenager for backing down from public threats against the FBI and Cl0p, especially after the ShinyHunters darknet portal abruptly went offline. Several commentators accused Rey of co-opting the established cybercrime brand for personal financial gain after its original founders were neutralized by international law enforcement.

"He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke," one community member alleged.

A dedicated Telegram monitoring channel has spent weeks tracking and doxing alleged members of the reconstructed ShinyHunters network. Administrators of the channel characterized Rey as an inexperienced newcomer attempting to capitalize on a notorious brand known for ruthlessly publishing stolen corporate data.

In previous statements to technology media outlets, representatives of the modern ShinyHunters collective asserted that their decision to target the FBI was a calculated public relations maneuver intended to counter official warnings issued by the agency. A May 2026 flash notice released by the Internet Crime Complaint Center (IC3) explicitly advised organizations against paying ransoms to the group, detailing tactics such as targeted harassment, phone threats, and swatting against executives and their families. While the hackers claimed their high-profile breaches demonstrated technical competence and undermined law enforcement warnings, industry analysts maintain that such public defiance ultimately accelerates international dragnet operations against the remaining affiliates.