ShinyHunters Suspect Detained as Group Allegedly Extorted Former Boeing Unit
Summary
A suspected ShinyHunters member was detained in Jordan while the group allegedly extorted Jeppesen ForeFlight, a former Boeing unit. Boeing is reviewing the claim; Jeppesen ForeFlight says it found no impact to operations or products.
Key points
- A suspected ShinyHunters member known as Rey was detained in Jordan and is reportedly cooperating with the FBI.
- Sources told KrebsOnSecurity that ShinyHunters was attempting to extort Jeppesen ForeFlight, which Boeing sold in 2025; Boeing acknowledged the claim and is reviewing it.
- Jeppesen ForeFlight said its investigation had found no impact to its operations or products.
- The alleged extortion involved theft of sensitive information that sources said could pose operational safety and security risks; the article does not independently establish the alleged theft or its scope.
- Mandiant and Google Threat Intelligence Group reported that ShinyHunters had mass-exploited a PeopleSoft vulnerability to steal data from dozens of organizations across multiple industries.
- Oracle issued a fix for CVE-2026-35273, and Mandiant published web application firewall rules for organizations unable to apply the update promptly.
- The article describes ShinyHunters as a shifting franchise, with affiliates and freelancers allegedly supplying stolen credentials in exchange for a share of ransoms.
Article Details
- Event Type
- Detention of a suspected ShinyHunters member amid alleged data theft and extortion targeting a former Boeing business unit, alongside reporting on ShinyHunters' mass exploitation of a PeopleSoft vulnerability.
- Impact
- ShinyHunters allegedly stole sensitive data from Jeppesen ForeFlight and attempted to extort the company; sources said the data could pose operational safety and security risks. Jeppesen ForeFlight said it had seen no impact to its operations or products. Separately, exploitation of CVE-2026-35273 reportedly exposed sensitive information on more than 5,000 FBI personnel and affected dozens of systems across multiple industries.
CVE
People
Benjamin KorperNeo Security owner who said he hired an outside firm to investigate whether van der Stap had hacked the company or its customers.Pepijn van der StapDutch cybercriminal arrested on suspicion of aiding ShinyHunters data thefts and extortions; the article also reports separate allegations that he tried to orchestrate murders.Saif al-Din KhaderAlso known as Rey; identified as a suspected ShinyHunters member detained by Jordanian authorities and reportedly cooperating with the FBI.
Threat Actors
Vendors
Google25, security experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability to steal data from dozens of systems across a range ofMandiantfix for CVE-2026-35273, which ShinyHunters first began exploiting as a zero-day in June, and at the time Mandiant released web application firewall rules intended for organizations that couldn’t apply the securityOraclea vulnerability (CVE-2026-35273) in PeopleSoft, a software-as-a-service platform from the tech giant Oracle that is broadly used by companies to manage hiring and human resources, benefits and payroll.
Products
Jeppesen ForeFlightThe logo for Jeppesen ForeFlight, a business unit divested last year by the aerospace firm Boeing.PeopleSoftgained access to the FBI site and other victims by exploiting a vulnerability (CVE-2026-35273) in PeopleSoft, a software-as-a-service platform from the tech giant Oracle that is broadly used by companies to
Countries
FranceSeveral commentators accused Rey of resurrecting the ShinyHunters brand after its core members were rounded up in France, and making a mockery of the group’s name and reputation ever since.JordanA teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang.NetherlandsMeanwhile, news outlets in the Netherlands reported explosive new allegations leveled at Van der Stap, whose supposed personal transformation from convicted to reformed hacker has been widely covered in the tech news
Industries
Aerospaceas ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing, which manufactures the fleet of planes used by the employer of Rey’s father — RoyalAgriculturedozens of systems across a range of industries, including higher education, technology, healthcare, agriculture, transportation and government.Governmentof industries, including higher education, technology, healthcare, agriculture, transportation and government.Healthcaresteal data from dozens of systems across a range of industries, including higher education, technology, healthcare, agriculture, transportation and government.Higher Educationvulnerability to steal data from dozens of systems across a range of industries, including higher education, technology, healthcare, agriculture, transportation and government.Technologyto steal data from dozens of systems across a range of industries, including higher education, technology, healthcare, agriculture, transportation and government.Transportationacross a range of industries, including higher education, technology, healthcare, agriculture, transportation and government.