Teen Suspected of Leading ShinyHunters Detained as Gang Targeted Boeing Spin-off

A teenager from Amman, Jordan, who uses the handle "Rey" and is suspected of leading the data theft and extortion group ShinyHunters, has been detained and is reportedly cooperating with the FBI to identify other members. KrebsOnSecurity reports that the arrest happened while the group was extorting a business unit recently divested by aerospace company Boeing. On October 3, Reuters cited three unnamed sources saying a suspected member named Saif Al-din Khader had been detained by Jordanian authorities. KrebsOnSecurity had identified Rey as Khader in a November 2025 profile.

The arrest follows Dutch police detaining 24-year-old Pepijn van der Stap on September 15, on suspicion of aiding ShinyHunters' data thefts and extortions. Straight after that arrest, Rey took control of the ShinyHunters brand. He boasted publicly about stealing sensitive FBI data and extorting the ransomware group Cl0p, and posted memes that appeared designed to frame the Dutchman for both hacks.

According to the earlier KrebsOnSecurity report, ShinyHunters reached the FBI site and other victims by exploiting a flaw (CVE-2026-35273) in Oracle PeopleSoft, a platform many companies use for hiring, human resources, benefits and payroll. The group began exploiting it as a zero-day (an unpatched flaw) in June. Oracle quickly issued a fix, and Mandiant released web application firewall rules for organisations that could not apply the update fast enough.