ShinyHunters Extorted Boeing Spin-off Prior to Arrests

Teen Hacker Detained Amid Boeing Spin-off Extortion Attempt

ShinyHunters, a notorious data theft and extortion group, was in the midst of attempting to extort a former business unit of Boeing when its alleged leader, a teenager identified as "Rey," was detained in Amman, Jordan. The suspect, believed to be Saif Al-din Khader, is reportedly cooperating with the FBI to identify other members of the hacking collective. This apprehension comes after a period of intense activity from ShinyHunters, including exploiting a vulnerability in Oracle's PeopleSoft platform to breach numerous organizations.

The Mechanics of the Extortion

The group's latest target? Jeppesen ForeFlight. That's a navigation and digital aviation unit Boeing divested last year. Sources said the stolen information could pose serious operational safety and security risks, and that's not something anyone in aviation takes lightly, because the stakes here involve real flights, real crews, and real passengers every single day. Boeing confirmed awareness of the extortion attempts. They said they're actively reviewing the matter with the Jeppesen ForeFlight team. But a spokesperson for Jeppesen ForeFlight asserted that their investigation to date revealed no impact on their operations or products.

Rey's alleged involvement in this high-profile extortion attempt is particularly noteworthy due to a potential connection to his father's employment at Royal Jordanian Airlines. That airline flies Boeings. It's a curious intersection. His family's professional life and his alleged criminal activities seem to touch, which is why this story keeps drawing attention from people who can't look away from the strange overlap. Rey had earlier said his father was an airline pilot, but that claim could not be independently confirmed. But evidence suggests his father used shared family computer credentials to access multiple online portals for Royal Jordanian Airlines employees, and that detail is what makes the whole thing feel less like coincidence and more like something worth asking about.

A Pattern of Exploitation

ShinyHunters gained notoriety by exploiting a vulnerability in Oracle's PeopleSoft software. CVE-2026-35273. That's the flaw they used. It's a platform widely used for human resources and payroll management, and this vulnerability was first exploited as a zero-day in June, which prompted Oracle to issue a fix, while Mandiant also released web application firewall rules to assist organizations unable to immediately apply the update. But initial attempts to breach the FBI's own PeopleSoft database didn't work. So they later employed a URL-encoding trick to bypass security measures.

Mandiant and Google Threat Intelligence Group confirmed it in a September 25 report. ShinyHunters mass-exploited the PeopleSoft vulnerability across higher education, technology, healthcare, agriculture, transportation, and government, and because a contractor at Accenture failed to patch the FBI recruitment website, which exposed sensitive data on over 5,000 FBI personnel, including their unit, specialization, and medical records, the FBI removed that contractor. But they're still exposed. It's a failure to patch. The report ties ShinyHunters to industries across the board, and the fallout shows how one unpatched system can put thousands of people's unit, specialization, and medical records at risk, which is exactly what happened here after the FBI stepped in and removed the Accenture contractor.

Rey's Role and the ShinyHunters Brand

Rey, who had previously been profiled by KrebsOnSecurity in November 2025 for his involvement with multiple ransomware groups, reportedly took control of the ShinyHunters brand following the arrest of Pepijn van der Stap, a Dutch cybercriminal, on September 15. Van der Stap was suspected of aiding ShinyHunters in data thefts and extortions. Immediately after Van der Stap's arrest, Rey publicly boasted about stealing data from the FBI and extorting the ransomware group Cl0p, even taunting them on Twitter/X.

Rey also tried to frame Van der Stap. He included images of his former hacker alias, "Umbreon," in his taunting posts. But many within the cybercriminal community have ridiculed Rey for his perceived amateurishness, particularly after he backed down from threats against the FBI and Cl0p, and they're not hiding their contempt. Some commentators accused him of resurrecting the ShinyHunters brand after its original French members were apprehended. It's a franchise now. Leadership succession occurs through arrest, they say, and we've seen how that works.

Broader Implications and Past Activities

The FBI's investigation into ShinyHunters gained renewed urgency with the group's attempted extortion of the former Boeing unit, which contained sensitive information that could pose risks to operational safety and security. In a public notice, the FBI had previously warned that ShinyHunters members employed various victim harassment strategies, including threatening text messages, phone calls to victims and their families, and swatting incidents. The group also sometimes falsely claimed to possess compromising information that did not exist.

ShinyHunters themselves claimed their attack on the FBI was intended to counter the agency's narrative and demonstrate their technical capabilities, calling it "fundamentally a public relations and marketing initiative for our business."

• ShinyHunters was extorting a former Boeing unit, Jeppesen ForeFlight, at the time of the arrest.
• The vulnerability exploited by ShinyHunters was in Oracle's PeopleSoft platform.
• An Accenture contractor was removed by the FBI for failure to patch the FBI recruitment website hacked by ShinyHunters.
• Data stolen from the FBI included sensitive information on over 5,000 personnel.

Meanwhile, new allegations emerged. They're against Pepijn van der Stap. He's the Dutch cybercriminal arrested on September 15. Investigators suspect he attempted to orchestrate at least two murders abroad, and Van der Stap, who had previously served prison time for data theft and extortion, had been working as an "offensive security lead" at Dutch cybersecurity company Neo Security. So Neo Security's owner confirmed an external firm was investigating potential hacking activities by Van der Stap against the company or its clients. But initial findings showed no evidence.