AMSTERDAM/AMMAN/WASHINGTON — The high-stakes chess match between international law enforcement and the modern cybercrime underworld has reached a dramatic crescendo. A teenager from Amman, Jordan, suspected of orchestrating the operations of the notorious data theft and extortion syndicate ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI.

The suspect, who operates under the hacker handle “Rey,” was cornered just as the collective was attempting an ambitious and aggressive extortion campaign against a recently divested business unit of global aerospace giant Boeing. Intriguingly, the dragnet closed around a young man whose father’s employer—Royal Jordanian Airlines—relies heavily on the very same commercial aircraft families manufactured by his son’s targeted corporate victim.

The high-profile capture of "Rey"—identified by researchers as Saif Al-din Khader—intertwines with a web of simultaneous law enforcement raids across Europe, multi-million-euro extortions, zero-day software vulnerabilities exploited at a massive scale, and stunning allegations of contract murder plots linked to a supposedly "reformed" cybercriminal in the Netherlands.

Main Facts

The collapse of the modern ShinyHunters apparatus hinges on a series of rapid developments that exposed the inner workings of an evolving, franchise-style cybercrime syndicate:

• The Suspect in Amman: Saif Al-din Khader (Rey), a teenager based in Amman, Jordan, was detained by local authorities following an intensive international investigation and is actively cooperating with the FBI to unmask other members of the hacking collective.
• The Boeing Connection: At the time of his apprehension, Rey was allegedly deep into an extortion campaign targeting Jeppesen ForeFlight, a digital aviation and navigation unit recently sold by Boeing to private equity firm Thoma Bravo for $10.55 billion. The breach posed acute operational safety and security risks.
• The Oracle PeopleSoft Zero-Day: The group’s recent wave of mass data thefts—affecting the FBI, universities, healthcare providers, and transport networks—was driven by the widespread exploitation of CVE-2026-35273, a critical vulnerability in Oracle’s PeopleSoft SaaS platform.
• The Dutch Raid: On September 15, 2026, Dutch police executed a dramatic flash-bang raid in Amsterdam, arresting 24-year-old convicted cybercriminal Pepijn van der Stap (formerly known as "Umbreon") on suspicion of aiding ShinyHunters’ data thefts.
• Shocking Murder-for-Hire Allegations: Dutch media outlets subsequently revealed that investigators suspect Van der Stap of orchestrating at least two contract murders abroad, casting a chilling shadow over his public rehabilitation narrative.

Chronology of an Escalation

The sequence of events leading to the dismantling and fracturing of the current ShinyHunters iteration spans nearly two years of digital cat-and-mouse games:

Late 2025: The Rise of Rey

In November 2025, cybersecurity journalist Brian Krebs published an exhaustive profile of "Rey," identifying him as a young administrative figure operating across multiple prominent ransomware and extortion ecosystems, including Lapsus$ and Scattered Spider affiliates. During this period, password-stealing malware compromised a shared family computer in Amman, leaking credentials that linked Rey’s household to Royal Jordanian Airlines employee portals.

June 2026: Zero-Day Exploitation Begins

ShinyHunters began mass-exploiting CVE-2026-35273, a vulnerability in Oracle PeopleSoft. Initially, the group targeted the FBI’s own PeopleSoft recruitment and HR database. While that specific breach was partially thwarted, the hackers pivoted, utilizing URL-encoding tricks to bypass web application firewall (WAF) rules issued by Mandiant. By late September, Google Threat Intelligence Group and Mandiant confirmed mass exploitation across dozens of global industries.

September 15, 2026: The Fall of "Umbreon"

Dutch authorities raided the Amsterdam residence of Pepijn van der Stap using flash-bang grenades. Van der Stap, who had recently completed a prison sentence for prior cybercrimes, was publicly posing as an "offensive security lead" at a Dutch cybersecurity firm named Neo Security.

September 16–22, 2026: Framing and Taunts

Immediately following Van der Stap’s arrest, Rey assumed control of the ShinyHunters brand. In a brazen attempt to frame the imprisoned Dutchman, Rey posted taunting memes to Twitter/X, mocking the FBI and the Cl0p ransomware gang while embedding the avatar of Van der Stap’s former alias, "Umbreon."

September 25–30, 2026: Brand Collapse and Offline Status

Security reports from Mandiant underscored the sheer scale of the PeopleSoft campaign. Meanwhile, the FBI’s darknet website ultimatum expired, causing the ShinyHunters leak site to go offline on September 30. Internal chat channels on Telegram erupted into chaos as rival threat actors ridiculed Rey for backing down from his threats.

October 3–6, 2026: Detainments Confirmed

Reuters and security researchers confirmed that Saif Al-din Khader had been detained in Jordan. Simultaneously, reports surfaced that the FBI had removed an Accenture contractor over failures to patch the PeopleSoft recruitment portal vulnerability that exposed records belonging to over 5,000 FBI personnel.

Supporting Data & Technical Vector

The technical engine powering ShinyHunters’ late-summer campaign relied on the exploitation of supply-chain and HR infrastructure. Oracle’s PeopleSoft platform—trusted globally by enterprises for payroll, human resources, and applicant tracking—became an Achilles’ heel.

When Oracle issued a patch for CVE-2026-35273, cybersecurity firm Mandiant released rapid-response WAF rules to protect unpatched networks. Undeterred, ShinyHunters utilized well-documented URL-encoding obfuscation techniques to slip past these perimeter defenses.

Data compiled by threat intelligence units indicates that the campaign compromised:

• Sectors Impacted: Higher education, technology, healthcare, agriculture, transportation, and government agencies.
• FBI Exposure: The breach of the FBI’s recruitment system exposed unit specializations, medical files, and psychiatric records for more than 5,000 active personnel.
• Financial Scale: Past iterations of ShinyHunters and their affiliates have been tied to data thefts spanning billions of records, while individual operators like Van der Stap were previously convicted for extortion schemes netting between €1.5 million and €2.7 million.

Official Responses

Corporate and governmental entities have scrambled to address the fallout from the ShinyHunters exposures and subsequent arrests:

• Boeing’s Statement: Acknowledging the extortion attempts, Boeing issued a statement clarifying that the targeted data originated from Jeppesen ForeFlight, a subsidiary sold to Thoma Bravo in November 2025. "We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson noted. "We are actively reviewing the matter with the Jeppesen ForeFlight team."
• Jeppesen ForeFlight Response: The aviation navigation unit maintained that its safeguards held strong. "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products."
• Neo Security’s Position: Benjamin Korper, owner of Neo Security—the firm that employed Van der Stap as an "offensive security lead"—told investigators he had hired an outside auditor to review Van der Stap’s work. Audits revealed no evidence that Van der Stap compromised internal networks or client systems during his brief tenure.
• The FBI’s Stance: In a May 2026 Flash Notice (PSA260515), the Bureau formally advised organizations against paying ransoms to ShinyHunters, noting the group’s aggressive tactics, which include swatting, doxing, and making false claims regarding compromising personal media. The hackers later admitted to The Register that their assault on the FBI’s portal was a "public relations and marketing initiative" designed to counter the Bureau’s discouraging warnings to victims.

Implications: The Franchise Model of Cybercrime

The events surrounding the downfall of "Rey" and "Umbreon" illustrate a fundamental evolution in how modern cybercrime syndicates operate. Security experts emphasize that today’s ShinyHunters bear little resemblance to the original French nationals who founded the brand in 2019 (many of whom faced French law enforcement actions years ago).

Instead, the modern iteration functions as a decentralized franchise model—akin to the legendary "Dread Pirate Roberts" persona from The Princess Bride. When one administrator is arrested or compromised, another freelancer steps into the vacuum, buying up old PGP keys, commandeering legacy Telegram channels, and trading on historical brand fear to extort organizations. Freelance affiliates feed stolen SaaS credentials to the brand in exchange for a 25% to 30% cut of ransom payouts.

However, this decentralized greed often leads to internal collapse. Rey’s youthful desire for notoriety—showcased by his public taunts, social media flexing, and attempts to frame peers—ultimately turned rival cybercriminal communities and investigative agencies directly against him. A hostile Telegram tracking group known as "The Battle" relentlessly doxxed and exposed his identity, compounding the pressure that culminated in his Jordanian detention.

As global law enforcement agencies close in on the remaining affiliates, the "ShinyHunters" moniker has shifted from a feared elite collective to a burned brand name—proving that in the digital underground, the pursuit of infamy is often a hacker’s most fatal vulnerability.