# Inside the Rise and Fall of ShinyHunters: A Teenager, a Ransomware Empire, and a Global Manhunt
**A sprawling cybercrime network once responsible for stealing billions of records has been unraveling after a series of high-profile arrests revealed internal fractures, rivalries, and a surprising cast of young operatives pulling the strings.**
—
## The Arrest That Changed Everything
In October 2026, Jordanian authorities in Amman detained a teenage suspect believed to have been running one of the most prolific data-theft and extortion operations on the dark web. The young man, who operated under the hacker alias **”Rey,”** is now reportedly cooperating with the United States Federal Bureau of Investigation in exchange for leniency, helping investigators trace the identities of other members of the hacking collective known as **ShinyHunters**.
What makes this case remarkable is the timing. Rey was taken into custody at a moment when ShinyHunters had turned its attention to a recently divested business unit of **Boeing**, the global aerospace giant — a target with deep ties to the teenager’s own family.
## A Family Connection Raises the Stakes
The Boeing subsidiary in question is **Jeppesen ForeFlight**, a digital aviation and navigation platform that Boeing sold in November 2025 to the private equity firm Thoma Bravo for approximately **$10.55 billion**. Sources close to the investigation told reporters that the data stolen from Jeppesen ForeFlight included highly sensitive information that could potentially compromise operational safety and security.
Boeing confirmed the extortion attempts but said the breach impacted only the former subsidiary, not its core operations. Jeppesen ForeFlight, for its part, stated that its own investigation found no evidence of disruption to its products or services.
The connection to Rey’s personal life adds an extraordinary dimension to the case. Evidence suggests that Rey’s father works as a pilot for **Royal Jordanian Airlines**, a carrier that operates a fleet of Boeing-manufactured aircraft. The teenager had reportedly bragged about this family tie on encrypted messaging platforms earlier in 2025. Further forensic analysis of a shared family computer revealed that Rey’s father had reused credentials across multiple employee portals for Royal Jordanian Airlines — credentials that may have initially drawn the attention of malicious actors in the first place.
Royal Jordanian Airlines has not publicly commented on the matter.
## How ShinyHunters Pulled Off Its Biggest Heists
The foundation of ShinyHunters’ success was a critical security flaw discovered in **PeopleSoft**, a widely used human resources and payroll management platform owned by the tech giant **Oracle**. The vulnerability, identified as **CVE-2026-35273**, allowed attackers to bypass authentication systems and access sensitive employee and contractor data.
Oracle released a patch relatively quickly, but many organizations — including government agencies and major corporations — were slow to apply it. Security firms **Mandiant** and the **Google Threat Intelligence Group** later confirmed that ShinyHunters had mass-exploited the vulnerability across dozens of systems spanning industries including higher education, healthcare, agriculture, transportation, and government.
Even more troubling was the FBI’s own exposure. An external contractor working for **Accenture** failed to patch the FBI’s recruitment website, which was running the vulnerable PeopleSoft software. The breach exposed the personal records of more than **5,000 FBI employees**, including their assigned units, areas of specialization, and even medical and psychiatric records. In the aftermath, the FBI terminated the contractor’s employment.
Ironically, the group that stole FBI data then had the audacity to mock the agency publicly. Rey posted taunting memes on social media, comparing his exploits to defeats of both the FBI and **Cl0p**, another well-known ransomware outfit. He even used images associated with a former associate’s alias in an apparent effort to misdirect blame.
## The Dutch Connection: A Convicted Criminal Turned Cybersecurity Consultant
As investigators closed in on ShinyHunters, another key player was being apprehended thousands of miles away. In the Netherlands, **Pepijn van der Stap**, a 24-year-old Dutch national with a prior conviction for cybercrime, was arrested in a police raid that reportedly involved flash-bang grenades at his residence on the evening of September 15, 2026.
Van der Stap’s story was unusual. He had served nearly four years in a Dutch prison for data theft and extortion schemes that allegedly generated between **€1.5 million and €2.7 million** in illicit proceeds. After his release, he landed a position as “offensive security lead” at a Dutch cybersecurity startup called **Neo Security**, led by owner **Benjamin Korper**. Korper has since hired an independent forensic team to investigate whether Van der Stap compromised his employer or any of the company’s clients — so far, no evidence of that has been found.
But the allegations against Van der Stap go far beyond data theft. Dutch news outlet RTL reported that investigators suspect he may have orchestrated **at least two murder-for-hire plots**, with the intended targets located abroad. Investigators believe there is evidence that Van der Stap directly ordered the attacks.
These revelations cast a dark shadow over the narrative of rehabilitation that had surrounded Van der Stap in the months leading up to his arrest. Before his initial 2023 apprehension, he had been working as a software engineer at a cybersecurity startup in Amsterdam while simultaneously volunteering at the **Dutch Institute for Vulnerability Disclosure** — all while allegedly hacking into and extorting major organizations.
In a recent interview, Van der Stap shrugged off skepticism about his transformation, saying, “You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced. I’m doing what I can to repay victims, and that’s all I can do.”
## A Brand Without a Home Team
One of the most fascinating aspects of the ShinyHunters case is how the organization itself has evolved — or perhaps deteriorated — over time. Security researchers and insiders now describe ShinyHunters less as a coherent hacking group and more as a **franchise model** that changes hands frequently.
The original core members were largely French nationals who had been arrested, and in some cases imprisoned, on multiple occasions for cybercrime. As those operators were rounded up, the ShinyHunters name was picked up by new hands — freelance hackers and affiliates who fed stolen credentials to SaaS platforms and took a cut of any ransom payments extracted from victims.
When Van der Stap was arrested, Rey stepped in and publicly seized control of the ShinyHunters brand. Within hours of Van der Stap’s detention, Rey posted images on social media claiming the group had breached both the FBI and Cl0p. He simultaneously removed references to Van der Stap’s old alias, “Umbreon,” from the narrative — a move many observers interpreted as an attempt to pin the blame on the now-arrested Dutchman.
However, the takeover was short-lived. Within days, a Telegram channel called **”The Battle”** — operated by members of the broader cybercrime community — began publicly doxing and mocking Rey and other self-proclaimed ShinyHunters affiliates. Commentators derided Rey as an opportunistic teenager riding the coattails of a reputation built by others.
“The group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes,” administrators of The Battle wrote publicly. They further alleged that Rey’s activities caused over **$200 million in damages** and helped approximately five or six separate groups profit from the ShinyHunters brand.
The group’s own darknet presence crumbled quickly. Its dedicated website went offline, and Rey — who had once been fearless in his online taunts — began systematically deleting his social media profiles, including the account he had used to mock the FBI and Cl0p. He preserved, however, a cybersecurity blog on **GitHub**, which contained detailed posts identifying the alleged core operators of Cl0p as two Russian men.
## Business of Extortion: How the Group Monetized Stolen Data
ShinyHunters has been active in various forms since at least 2019, and the group’s total toll is staggering — billions of stolen records across hundreds of organizations. But how exactly did they turn data theft into a revenue stream?
The group employed several well-known extortion tactics. They sent threatening messages to victims and, in some cases, to the victims’ family members. They made threatening phone calls. In extreme cases, they reportedly engaged in **swatting** — the dangerous practice of falsely reporting an emergency to dispatch law enforcement to a victim’s address.
The FBI, in a public advisory issued in May 2026, warned that ShinyHunters members frequently claimed to possess compromising or embarrassing material about their targets — material that, in many cases, did not actually exist. The advisory was designed to discourage victims from paying ransom demands.
In response, ShinyHunters told **The Register** that their breach of the FBI’s systems was partly a direct counter to that advisory. “This was fundamentally a public relations and marketing initiative for our business,” the group said, framing the attack as proof that they had the technical chops to follow through on any threat — regardless of how law enforcement tried to frame the narrative.
## What Happens Next?
Rey’s cooperation with the FBI could prove to be the most significant development yet. If the teenager provides actionable intelligence about remaining ShinyHunters affiliates, it could lead to a new wave of arrests across multiple countries. The investigation is now focused on identifying the remaining freelancers and affiliates who sustained the group’s operations after the original French members were apprehended.
Meanwhile, Van der Stap’s case continues to unfold in the Netherlands, where murder-for-hire allegations add an entirely new legal dimension to what was already a complex cybercrime prosecution. Neo Security, the firm that employed Van der Stap, has distanced itself from the allegations while commissioning its own independent investigation.
The ShinyHunters saga serves as both a cautionary tale about the vulnerabilities of widely deployed enterprise software and a reminder that the dark web economy operates on reputation, branding, and a fragile chain of trust — all of which can collapse when the people behind the brand are no longer free to operate.
—
## Frequently Asked Questions (FAQ)
**Q: Who is “Rey” and why is his arrest significant?**
A: “Rey” is the hacker alias of Saif Al-din Khader, a teenager from Amman, Jordan. His arrest is significant because he was allegedly running the ShinyHunters operation at a critical time, targeting high-value victims including Boeing’s former subsidiary and even making threats against the FBI itself. His cooperation with investigators could expose the broader network behind the group.
**Q: What is ShinyHunters and what have they done?**
A: ShinyHunters is a data theft and extortion group that has been active since at least 2019, responsible for breaches involving billions of stolen records. They gained access to sensitive systems by exploiting a vulnerability in Oracle’s PeopleSoft platform and extorted victims across industries including government, healthcare, education, and aviation.
**Q: How did ShinyHunters breach the FBI’s systems?**
A: The FBI’s recruitment website was running Oracle’s PeopleSoft software and had not been patched against vulnerability CVE-2026-35273. An external contractor for Accenture failed to apply the security update, leaving the site exposed. The breach revealed personal data on over 5,000 FBI personnel, including medical records and specialized unit assignments.
**Q: What is the Boeing Jeppesen ForeFlight connection?**
A: Jeppesen ForeFlight is a digital aviation platform that Boeing sold to private equity firm Thoma Bravo in late 2025. ShinyHunters allegedly stole sensitive data from this subsidiary and attempted to extort the company, raising concerns about operational safety and security risks tied to aviation navigation data.
**Q: Who is Pepijn van der Stap and what are the murder allegations?**
A: Van der Stap is a 24-year-old Dutch national convicted of cybercrime who was released from prison and hired as a cybersecurity consultant. Dutch investigators now suspect he orchestrated at least two murder-for-hire attacks abroad. His arrest came in a dramatic police raid on September 15, 2026.
**Q: Why did ShinyHunters hack the FBI?**
A: According to ShinyHunters themselves, the breach was partly a response to an FBI public advisory warning victims not to pay ransom to the group. The hackers framed the attack as a way to demonstrate their technical capabilities and to counter what they called misinformation about the group.
**Q: Is ShinyHunters still active?**
A: The original core members of ShinyHunters have largely been arrested or imprisoned. However, the group’s name has been adopted by freelance hackers and affiliates — a model sometimes described as “franchising.” Whether these newer operators will sustain any meaningful activity remains uncertain, especially with Rey now cooperating with law enforcement.
**Q: What can organizations do to protect themselves from similar attacks?**
A: Promptly applying security patches, particularly for widely used enterprise software like PeopleSoft, is critical. Organizations should also implement robust web application firewalls, conduct regular vulnerability assessments, and enforce strong credential hygiene — including avoiding password reuse across employee portals.
—
## Conclusion
The dismantling of ShinyHunters represents a pivotal moment in the global fight against cybercrime. From a teenage operator in Amman leveraging his family’s ties to major aviation companies, to a convicted cybercriminal moonlighting as a security consultant, to a decentralized network of affiliates exploiting one of the world’s most widely used HR platforms — this case exposes how deeply interconnected, audacious, and fragile modern cybercrime operations can be.
The cooperation of a young suspect with the FBI signals a potential domino effect: as more members are identified, arrested, and turned, the infrastructure that allows groups like ShinyHunters to operate — their branding, their forums, their trusted affiliate networks — begins to crumble. Yet the underlying vulnerabilities that enabled these breaches remain, a reminder that no organization, government agency, or corporation is immune to the cascading consequences of a single unpatched system.
The story of ShinyHunters is far from over, and the full scope of its victims, its damages, and its legacy will likely take years to fully understand.
—
Thank you for reading
