A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group Shiny Hunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. Krebs On Security has learned that the suspect, who uses the hacker handle “Rey,” was detained as Shiny Hunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing, which manufactures the fleet of planes used by the employer of Rey’s father — Royal Jordanian Airlines.
On October 3, Reuters cited three unnamed sources saying a suspected Shiny Hunters member in Amman named Saif Al-din Khader was detained by Jordanian authorities and was cooperating with the FBI. Krebs On Security identified Rey as Khader in a November 2025 profile. The story noted that immediately following the Dutchman’s arrest on the evening of September 15, Rey assumed control over the Shiny Hunters brand and boasted publicly about stealing highly sensitive data from the FBI and extorting the ransomware group Cl0p.
Shiny Hunters gained access to the FBI site and other victims by exploiting a vulnerability (CVE-2026-35273) in People Soft, a software-as-a-service platform from Oracle. Reuters reported October 5 that the FBI has removed a contractor at Accenture over their failure to patch the FBI recruitment website hacked by Shiny Hunters, which exposed sensitive data on more than 5,000 FBI personnel.
According to two sources familiar with the Shiny Hunters investigation, a navigation and digital aviation unit recently divested by Boeing was among the victims that Shiny Hunters was in the process of extorting when Rey was apprehended by Jordanian authorities. Those sources said the FBI’s investigation into Shiny Hunters gained renewed urgency with the group’s attempted extortion of the former Boeing unit, which allegedly included the theft of sensitive information.
Source: Hacker News · Summarized by HeadlinesBriefing