The ShinyHunters extortion group was trying to extort Jeppesen ForeFlight, the aviation navigation business Boeing sold last year, when an alleged member was detained in Jordan, Krebs on Security reported Wednesday. Sources told security journalist Brian Krebs that the stolen information could pose operational safety and security risks, though what it contains has not been disclosed.

What Happened

Jeppesen ForeFlight is the navigation and digital aviation unit that Boeing sold to private equity firm Thoma Bravo in November 2025 for $10.55 billion. According to Krebs, ShinyHunters stole sensitive data from the company and was in the middle of extorting it when the member known as Rey was apprehended.

Boeing said it is aware of a threat actor's claims about data allegedly associated with Boeing and its former subsidiary and is reviewing the matter with the Jeppesen ForeFlight team. A Jeppesen ForeFlight spokesperson said that, based on its investigation to date, there was no impact on the company's operations or products.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The report does not say how Jeppesen ForeFlight was breached, and no ransom demand is reported. Krebs noted that during the same period ShinyHunters was mass-exploiting CVE-2026-35273, a vulnerability in Oracle's PeopleSoft software, and that roughly 70 organizations in higher education, technology, health care, agriculture, transportation and government were compromised through it.

Why It Matters

Jeppesen is best known for the aeronautical charts and navigation data that airlines and pilots rely on, and ForeFlight makes widely used flight-planning software. That is why sources flagged safety concerns: data from a supplier at that point in the aviation chain is more sensitive than ordinary corporate records, even if the company says its products were not affected.

The case also shows how far the PeopleSoft campaign reached beyond the high-profile victims already public, including the FBI's recruitment website. Krebs reported that the group continued exploiting the flaw after Mandiant suggested firewall rules, using URL encoding to get around them.

The Arrests and What Came After

This report follows our earlier coverage of the detention in Jordan of the suspect known as Rey, whom Reuters identified as Saif al-Din Khader and who is reportedly cooperating with the FBI. Dutch police arrested another alleged member, 24-year-old Pepijn van der Stap, on Sept. 15.

The arrests have not retired the brand. Krebs describes ShinyHunters as a kind of franchise that multiple operators can claim, and says the scene has splintered into rival Telegram channels. One of them, called "The Battle," spent weeks doxing and taunting Rey and other alleged members and built a large following in cybercrime circles. Sources also told Krebs the FBI is tracking freelancers who feed stolen software-as-a-service credentials to the group in exchange for a cut of ransom payments.

What to Watch

Boeing's and Jeppesen ForeFlight's reviews may establish what was taken and whether customers need to be notified. Other PeopleSoft victims could surface as investigators work through Rey's devices and messages, and splinter groups using the ShinyHunters name may still try to leak or sell data stolen before the arrests.