ShinyHunters Leader Nabbed Mid-Extortion of Boeing Spin-off

Jordanian authorities have detained a teenager from Amman named Saif Al-din Khader, known online by the handle "Rey." According to Reuters, he is believed to be one of the leaders of ShinyHunters — a prolific data-theft and extortion crew — and is now cooperating with the FBI to identify other members.

KrebsOnSecurity reports that the arrest coincided with ShinyHunters attempting to extort Jeppesen ForeFlight, a digital-aviation unit that Boeing sold to private equity firm Thoma Bravo in November 2025 for $10.55 billion. Boeing confirmed it received the demands and is reviewing the matter with the Jeppesen ForeFlight team, while the company itself said neither its operations nor products were affected. Sources claim the stolen data could pose risks to flight safety, which reportedly lent the FBI probe fresh urgency.

A king named Rey

The most striking twist is a family connection. The handle "Rey" means "king," and the teenager's father appears — based on harvested data — to work for Royal Jordanian Airlines, a state-controlled carrier whose long-haul fleet consists of Boeing planes. In other words, the young man was targeting the maker of the very aircraft his father depends on. Rey claimed his father was a pilot, though that could not be confirmed.

Hacking the FBI and borrowing a name

ShinyHunters reached victims through a vulnerability in Oracle's cloud platform PeopleSoft (CVE-2026-35273), which they exploited as a zero-day beginning in June. Among the victims was the FBI's recruitment site: data on more than 5,000 personnel leaked, down to medical and psychiatric records. Rey publicly mocked both the FBI and the rival Cl0p group with memes, meanwhile trying to frame arrested Dutch hacker Pepijn van der Stap.

Experts stress that today's ShinyHunters are no longer the French founders, most of whom have been arrested. The brand has become a kind of franchise where the name passes not by inheritance but by arrest, and several bearers may operate at once. In private Telegram channels, Rey was ridiculed for "resurrecting" the notorious name by buying the old forum's PGP key and trading on borrowed credibility. His critics estimate he caused over $200 million in damages in a matter of months.

ShinyHunters themselves, in an interview with The Register, admitted the FBI hack was first and foremost a "public relations and marketing initiative": the bureau's May advisory urging victims not to pay had badly hurt their business.

Source: Krebs on Security