Alleged ShinyHunters Leader "Rey" Detained in Jordan and Cooperating With the FBI Amid Broad Extortion Crackdown

A teenager from Amman, Jordan, suspected of leading the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation to help identify other members of the hacking collective.

According to reports from investigative journalist Brian Krebs, the suspect—who operates under the hacker handle “Rey”—was apprehended just as ShinyHunters was actively extorting a business unit recently divested by global aerospace giant Boeing. Intiguingly, the company manufactures the aircraft fleet used by Royal Jordanian Airlines, the employer of Rey’s father.

The Capture of "Rey" and Global Fallout

On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been taken into custody by Jordanian authorities and was actively cooperating with the FBI. KrebsOnSecurity had previously identified Rey as Khader in a November 2025 profile, during which the young man admitted to collaborating with multiple ransomware operations.

Rey’s name resurfaced in late September following an exclusive report detailing the Dutch police’s arrest of 24-year-old convicted cybercriminal Pepijn van der Stap, who is suspected of assisting ShinyHunters with data thefts and extortions. Immediately following Van der Stap’s arrest on the evening of September 15, Rey seized control of the ShinyHunters brand online, publicly boasting about stealing highly sensitive data from the FBI and extorting the rival ransomware group Cl0p.

Rey proceeded to taunt both law enforcement and the Cl0p syndicate using memes posted to his long-standing Twitter/X account. At the same time, he incorporated images of the avatar utilized by Van der Stap’s former hacker alias, “Umbreon,” in a transparent bid to frame the Dutch national for both high-profile hacks.

The underlying infrastructure security failure traced back to an enterprise software vulnerability. ShinyHunters gained access to the FBI’s recruitment portal and other corporate victims by exploiting a critical zero-day vulnerability (tracked as CVE-2026-35273) in PeopleSoft, a software-as-a-service platform owned by Oracle that is widely used for enterprise hiring, human resources, benefits, and payroll management.

Oracle swiftly issued a patch after the exploit surfaced in June, while cybersecurity firm Mandiant released defensive web application firewall rules for organizations unable to immediately apply the update. Despite these mitigations, ShinyHunters later bypassed the firewall protections using a well-known URL-encoding trick.

By late September, security experts at Mandiant and the Google Threat Intelligence Group confirmed that the group had mass-exploited the PeopleSoft flaw, compromising dozens of systems across higher education, technology, healthcare, agriculture, transportation, and government sectors. The fallout also extended to third-party vendors; Reuters reported that the FBI removed an Accenture contractor after a security failure exposed sensitive data on more than 5,000 FBI personnel, including unit specializations, medical histories, and psychiatric records.

"Rey" Means King, as in Royal

Investigators familiar with the case revealed that a digital navigation and aviation unit recently divested by Boeing was among the active extortion targets when Jordanian law enforcement moved in. The FBI’s investigation took on heightened urgency due to the nature of the stolen data, which sources noted posed potential operational safety and security risks.

Boeing formally acknowledged the extortion attempts in a statement, confirming the incident involved data stolen from Jeppesen ForeFlight, a subsidiary that Boeing sold in November 2025 to private equity firm Thoma Bravo for $10.55 billion. Representatives for Jeppesen ForeFlight maintained that their internal investigation found no subsequent impact on ongoing operations or products.

Rey’s alleged role in targeting the former Boeing unit carries personal irony. Strong evidence indicates his father is employed by Royal Jordanian Airlines, a government-controlled carrier operating long-haul routes on Boeing aircraft. While Rey claimed on Telegram in early 2025 that his father was an airline pilot—a claim that could not be independently verified—password-stealing malware recovered from a shared family computer revealed that his father used identical credentials across multiple portal logins for Royal Jordanian Airlines employees.

Following inquiries from journalists, Rey began scrubbing his digital footprint, deleting various social media accounts, including his primary Twitter/X profile. However, a cybersecurity blog hosted on GitHub escaped the purge, featuring a detailed post published in March 2026 that doxed two Russian men alleged to be the core developers and operators behind the Cl0p ransomware platform.

Murder-for-Hire Allegations in the Netherlands

Meanwhile, legal proceedings in the Netherlands have introduced far more sinister allegations against Pepijn van der Stap, whose narrative of post-prison reform had previously found a receptive audience in tech circles. Dutch daily RTL reported on September 29 that investigators suspect Van der Stap attempted to orchestrate at least two murders abroad, allegedly issuing direct orders for the attacks.

Van der Stap had recently completed the majority of a four-year prison sentence for data theft and extortion schemes that prosecutors estimated yielded between 1.5 million and 2.7 million euros. Following his release, he secured employment as an "offensive security lead" at Dutch cybersecurity firm Neo Security. Neo Security’s owner, Benjamin Korper, stated that an independent firm was hired to audit the company’s networks following Van der Stap’s September 15 arrest—which involved a dramatic police raid utilizing flash-bang grenades—though no evidence of internal compromise has been found.

Prior to his initial 2023 conviction, Van der Stap worked as a software engineer at Amsterdam-based cybersecurity startup Hadrian while volunteering for the Dutch Institute for Vulnerability Disclosure, all while participating in corporate extortion operations. When questioned prior to his second arrest regarding his deception of colleagues and the media, Van der Stap maintained that his remediation efforts spoke for themselves.

Franchising and Burning a Brand

While cybercriminals operating under the ShinyHunters banner have claimed responsibility for dozens of high-profile data breaches involving billions of stolen records since 2019, security experts emphasize that the current operators bear little resemblance to the group’s original French core, most of whom have already faced arrest and imprisonment.

Instead, ShinyHunters has transformed into a decentralized franchise—reminiscent of a digital "Dread Pirate Roberts" model where succession is dictated by law enforcement intervention rather than death, allowing multiple individuals to operate under the moniker simultaneously. Investigators indicate that the FBI is concentrating its efforts on a remaining cohort of independent affiliates who supply stolen enterprise SaaS credentials in exchange for a percentage of ransoms paid by victims.

In the wake of Van der Stap’s arrest and Rey’s detention, cybercrime discussion channels on Telegram erupted with criticism directed at the teenage hacker. Critics accused Rey of cheapening the group’s reputation by co-opting the established brand to run ad-hoc extortion scams after the original members were neutralized.

"He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies," one forum member noted.

The attacks and subsequent exposure prompted a public relations crisis for the cybercrime group. In May, the FBI issued a formal flash notice warning organizations against paying ransoms to ShinyHunters and highlighting the group’s aggressive tactics, which include swatting victims and threatening their families. In response, the hackers claimed their breach of the FBI was designed to showcase their technical prowess and counter what they characterized as misinformation spread by law enforcement and security researchers, while privately conceding that the FBI’s warnings severely damaged their leverage in extortion negotiations.