The Fall of "Rey": How a Teenage Hacker, a Stolen Brand, and Oracle Flaws Unleashed a Global Cyber Extortion Crisis

AMMAN / WASHINGTON / AMSTERDAM — In the murky underworld of international cybercrime, few monikers carry as much weight—or as much infamy—as ShinyHunters. Responsible for massive data thefts and high-stakes extortions stretching back to 2019, the collective has long operated as a digital phantom. However, a sweeping, multi-jurisdictional law enforcement dragnet has begun tearing away the group’s veil of anonymity.

At the center of this geopolitical cyberstorm is a teenager from Amman, Jordan, known by the hacker handle “Rey.” Detained by Jordanian authorities and reportedly cooperating with the FBI, Rey’s alleged reign as the self-appointed captain of the ShinyHunters franchise has unraveled. His arrest—paired with simultaneous high-profile raids in Europe and shocking allegations of murder-for-hire plots—highlights a dangerous new era of cybercrime: one defined by teenage copycats, corporate software-as-a-service (SaaS) vulnerabilities, and the corporate branding of extortion syndicates.

Main Facts: The Detention of "Rey" and the Unraveling of a Syndicate

Recent investigative findings reveal that Saif Al-din Khader, operating under the handle “Rey,” was taken into custody by local authorities in Amman. Security researchers and media outlets, including KrebsOnSecurity and Reuters, have confirmed that Khader is actively cooperating with the Federal Bureau of Investigation (FBI) to unmask remaining members of the hacking syndicate.

Rey’s apprehension occurred precisely as the ShinyHunters network was heavily embroiled in an aggressive extortion campaign targeting a business unit recently divested by global aerospace giant Boeing. This particular breach crossed a red line for federal investigators, injecting severe urgency into an already high-profile manhunt.

The fallout from the syndicate’s recent activities has been catastrophic:

• The FBI Breach: Exploiting a zero-day vulnerability in Oracle PeopleSoft software, ShinyHunters breached internal databases, including an FBI recruitment portal managed by an Accenture contractor. This exposure compromised sensitive personal and medical records of more than 5,000 FBI personnel.
• The Franchise Model: Cybersecurity experts note that the modern iteration of ShinyHunters bears little resemblance to its original French-led core, most of whom have been arrested or imprisoned. Instead, the moniker has become a decentralized "franchise"—akin to the mythical Dread Pirate Roberts—where opportunistic freelancers inherit the brand to extort corporations for a percentage of the ransom.
• Global Sweep: The crackdown extends far beyond Jordan. Dutch police recently raided the home of 24-year-old Pepijn van der Stap (formerly known as "Umbreon"), a convicted cybercriminal whose arrest triggered a bizarre chain of events that ultimately brought Rey’s operation crashing down.

Chronology: From Zero-Day Exploits to Midnight Raids

To understand how a teenager in Jordan managed to rattle the world’s premier law enforcement agency and a multi-billion-dollar aerospace conglomerate, one must trace the timeline of escalating digital and physical confrontations that defined late 2025 and 2026.

June – August 2026: The PeopleSoft Zero-Day Campaign

ShinyHunters began mass-exploiting a critical vulnerability (CVE-2026-35273) within Oracle PeopleSoft, a widely utilized SaaS platform governing human resources, payroll, and recruitment. Although Oracle quickly issued patches, and security firms like Mandiant released web application firewall (WAF) mitigations, the threat actors utilized URL-encoding tricks to bypass defenses. Their initial, explicit target was the FBI’s own PeopleSoft database. While direct penetration of that specific database proved elusive, the broader campaign successfully compromised systems across higher education, healthcare, technology, and government sectors.

September 15, 2026: The Dutch Raid

In a dramatic operation featuring flash-bang grenades, Dutch special police units raided the Amsterdam residence of Pepijn van der Stap. Van der Stap, who had publicly branded himself as a "reformed hacker" working as an "offensive security lead" for local cybersecurity firm Neo Security, was arrested on suspicion of aiding ShinyHunters’ data thefts.

September 15–22, 2026: The Hijacking of a Brand

Immediately following Van der Stap’s arrest, Rey assumed operational control of the ShinyHunters brand online. Eager to project power, Rey publicly boasted about compromising the FBI and extorting the notorious Cl0p ransomware gang. In an attempt to frame Van der Stap, Rey peppered his taunting memes on Twitter/X with images of "Umbreon"—Van der Stap’s former hacker avatar.

September 28 – October 6, 2026: The Dominoes Fall

• September 28: Investigative reports linked Rey directly to Saif Al-din Khader. Shortly after journalists emailed Khader’s father for comment, Rey began aggressively scrubbing his social media profiles.
• September 29: Dutch media outlet RTL published explosive allegations that investigators suspect Van der Stap of orchestrating at least two contract murders abroad.
• September 30: The primary ShinyHunters darknet extortion portal went offline following an unheeded FBI ultimatum.
• October 3: Reuters confirmed Khader’s detention in Amman and his subsequent cooperation with the FBI.
• October 5–6: Reports emerged that the FBI terminated an Accenture contractor after the firm failed to patch the recruitment portal vulnerability exploited by the hackers.

Supporting Data: Infrastructure, Vulnerabilities, and the Boeing Nexus

The operations of modern cybercrime syndicates rely heavily on corporate supply chain oversights and the weaponization of third-party platforms.

The Oracle PeopleSoft Attack Vector

CVE-2026-35273 served as the crown jewel for ShinyHunters’ 2026 campaign. Because Oracle PeopleSoft handles deeply sensitive corporate operations—ranging from payroll to candidate screening—a successful breach grants attackers immediate access to internal organizational layouts. According to a joint threat intelligence report by Mandiant and the Google Threat Intelligence Group (GTIG), this vector allowed the syndicate to harvest gigabytes of proprietary data across dozens of multinational firms before security updates could be fully deployed.

The Jeppesen ForeFlight Extortion

The investigation reached a critical inflection point when ShinyHunters targeted Jeppesen ForeFlight, a digital aviation and navigation unit previously owned by Boeing. Boeing sold the subsidiary to private equity firm Thoma Bravo in November 2025 for $10.55 billion. The theft of proprietary aviation data from this unit triggered intense alarm bells within the U.S. national security apparatus due to potential operational safety implications.

The Royal Jordanian Connection

Rey’s targeting of a Boeing-adjacent entity carried a poignant irony. Investigative evidence indicates that Rey’s father is an employee of Royal Jordanian Airlines, a carrier largely controlled by the Jordanian government that relies entirely on long-haul Boeing fleets. Password-stealing malware recovered from a family computer previously demonstrated that Rey’s father utilized identical credentials across multiple airline staff portals, casting a glaring light on the precarious intersection of domestic life and illicit digital enterprises.

Official Responses: Corporations and Agencies Respond

As the dust settles on the multi-nation arrests and data exposures, targeted entities and cybersecurity firms have issued formal statements addressing the breaches and the broader threat landscape.

• Boeing & Jeppesen ForeFlight: In a joint statement, Boeing acknowledged the threat actor’s claims regarding data associated with Jeppesen ForeFlight. "We are actively reviewing the matter with the Jeppesen ForeFlight team," a Boeing spokesperson noted. Meanwhile, Jeppesen ForeFlight insisted that internal investigations showed "no impact to our operations or products."
• Neo Security: Following the arrest of their "offensive security lead," Pepijn van der Stap, Neo Security owner Benjamin Korper confirmed that an independent forensic firm was hired to audit company networks. Korper stated that initial reviews yielded zero evidence that Van der Stap had turned his skills against his employer or its clients.
• The Federal Bureau of Investigation (FBI): The bureau’s public posture regarding ShinyHunters has been unusually aggressive. Following a May 2026 advisory warning victims against paying ransoms—and detailing the group’s aggressive tactics, including doxxing, harassment, and swatting—ShinyHunters took the extraordinary step of hacking the FBI itself. The hackers claimed the breach was a "public relations and marketing initiative" designed to discredit the agency’s warning.

Implications: The Death of a Brand and the Evolution of Cyber Extortion

The simultaneous neutralization of key figures like Pepijn van der Stap in Europe and Saif Al-din Khader in Jordan marks a major turning point in the global fight against ransomware and data extortion cartels. However, cybersecurity analysts warn that arresting individual hackers does little to eradicate the underlying ecosystem.

The "Dread Pirate Roberts" Problem

Because cybercrime syndicates increasingly operate as franchises, dismantling a core group simply invites opportunistic novices to pick up the mantle. As observed in Rey’s case, teenage hackers and opportunistic script-kiddies can easily purchase PGP keys, resurrect darknet domains, and adopt famous monikers like ShinyHunters to inflate their perceived leverage.

However, as community backlash on Telegram channels like "The Battle" demonstrated, playing dress-up with a notorious brand carries heavy risks. Rey’s public grandstanding, amateurish tactical retreats, and ultimate betrayal of his peers through FBI cooperation have turned him into a pariah within the very underground communities he sought to lead.

A Warning to the Underworld

Ultimately, the downfall of "Rey" and "Umbreon" sends a chilling message to digital extortionists worldwide: the boundary between pseudonymous online bravado and real-world accountability is razor-thin. As international law enforcement agencies close cooperation gaps and private-sector threat intelligence teams map out the intricate webs connecting SaaS vulnerabilities to individual keyboard operators, the era of unpunished enterprise-scale extortion is facing its toughest reckoning yet.