ShinyHunters extorted Boeing spin-off before suspect's arrest in Amman

What happened and what to do

According to the KrebsOnSecurity report, a young man from Amman, Jordan, suspected of leading the ShinyHunters group, was detained while the group attempted to extort Jeppesen ForeFlight, a business unit separated from Boeing last year. Reuters, citing anonymous sources, reported on 3 October that the suspect was cooperating with the FBI. The report also says the group exploited vulnerability CVE-2026-35273 in Oracle's PeopleSoft, which the vendor patched and which was exploited as a zero-day since June, and that it later bypassed web application firewall rules suggested by Mandiant using URL encoding.

For companies running HR, payroll and benefits systems, the case shows two concrete risks: slow patch deployment and overreliance on generic firewall rules that are easily bypassed. A practical response includes inventorying internet-facing PeopleSoft or other SaaS platforms, monitoring access attempts with unusual encoding patterns, logging and alerting on anomalous requests, and maintaining a patching workflow with defined deadlines. It is also useful to restrict access to sensitive data, reduce exportable information, and prepare an extortion response plan.

How the consultancy can help

Diagnosis of exposure to enterprise platforms such as PeopleSoft, mapping systems, versions and external access paths. Then design and implementation of monitoring pipelines for suspicious web requests, alerts and dashboards for the security team, with ongoing operation in the client's environment.

Next step

If your company uses HR, payroll or benefits systems exposed to the internet, send a brief description of your environment and your update process. With that information we will prepare an initial diagnosis and a scoped proposal.