A Pirate Wi-Fi Network at 10,000 Meters Altitude

On August 10, 2026, shortly after the conclusion of DEF CON 34 in Las Vegas, an unusual cybersecurity incident occurred aboard Delta Air Lines Flight 591, connecting Harry Reid International Airport (Las Vegas) to Atlanta. According to several American media sources that consulted internal messages from the plane, one or more passengers reportedly deployed a pirate Wi-Fi network in mid-flight, presumably to intercept the credentials of other travelers.

Delta Air Lines confirmed the incident to BleepingComputer and CyberScoop, stating that "an unauthorized Wi-Fi network, which was not provided, operated, or supplied by Delta, was present onboard the aircraft for a short duration during the flight." The airline emphasized that “flight safety was never compromised and no operational systems of the aircraft were affected.”

The airplane, a Boeing 757 carrying 199 passengers and 6 crew members, was originally scheduled to depart on Sunday, August 10, but only left Las Vegas at 8:30 AM on Monday morning, according to CyberScoop. No emergency was declared to air traffic control.

ACARS Messages: “They are trying to scam the other passengers”

The most troubling detail of this incident comes from ACARS messages (Aircraft Communications Addressing and Reporting System) exchanged between the crew and ground staff. An aeronautics technician based in Nairobi, known online by the pseudonym “Turbine Traveller,” made these messages public, relayed by BleepingComputer:

“We have a group of PAX [passengers] who were at a cybersecurity conference in Las… They managed to scramble our Wi-Fi and broadcast their own signal.”

“We have a PAX who created a scam Wi-Fi called Delta WiFi Fast. We think they are trying to scam the other PAX.”

According to TechCrunch, the pilots sent two in-flight messages to air traffic control to report that a passenger had "created a fraudulent Wi-Fi" designed to mimic the aircraft's legitimate wireless network.

Deauthentication Attack and “Evil Twin”: The Mechanism

The incident displays the classic characteristics of an “evil twin” attack coupled with a Wi-Fi deauthentication attack, as explained by both BleepingComputer and CyberScoop:

  1. Deauthentication (deauth): the attacker monitors wireless traffic to identify the MAC address of the legitimate access point, then forges deauthentication frames by impersonating that access point. By continuously sending these frames, they repeatedly disconnect clients from the legitimate network, causing a denial of service.
  2. Rogue AP / evil twin: a pirate access point clones the name (SSID) and parameters of the legitimate network. Once devices are disconnected from the true network, they automatically reconnect to the rogue network.
  3. Interception: once connected to the rogue access point, victims may see their unencrypted traffic monitored, be subjected to man-in-the-middle attacks, or be redirected to counterfeit captive portals designed to steal credentials.

It is precisely this last scenario that appears to have occurred. According to Mary Perrault, a member of online frequent traveler groups but without official affiliation with Delta, the fake Wi-Fi network displayed a phishing page that collected “personal credentials and Google login data.”

Networks implementing the Protected Management Frames (PMF / 802.11w) standard can mitigate this type of frame spoofing attack.

Crew Response and Authorities Intervention

Alerted by the presence of the unauthorized network, the cabin crew disabled the Wi-Fi functionality of the aircraft for about 30 minutes. Upon landing, once the plane was parked at the gate, federal authorities and airport police boarded the aircraft to question the suspects and seize the portable Wi-Fi equipment, according to Mary Perrault.

Morgan Durrant, a spokesperson for Delta, told both TechCrunch and CyberScoop:

“We are conducting a thorough investigation to gather a complete set of facts, which will take time. We will work with federal law enforcement and aviation regulators to ensure that the incident is thoroughly reviewed. We thank our crew for their professionalism and our customers for their understanding.”

FBI, FAA, TSA: Slightly Diverging Versions

The responses from the agencies vary according to the sources, a point that article cross-referencing highlights:

  • CyberScoop indicates that the FBI’s Atlanta office and the FAA stated they were aware of the incident, without providing further comment. The Transportation Security Administration (TSA) referred CyberScoop to the FBI, and Homeland Security Investigations did not respond.
  • TechCrunch reports that the Atlanta police redirected inquiries to federal authorities, that the FBI had "not immediately responded," and that Steve Kulm, a spokesperson for the FAA, stated that the agency had not received a report on the incident.

This divergence — FAA "aware" according to CyberScoop but "no report received" according to TechCrunch — suggests either a timing discrepancy in communications or a distinction between informal information and an official report. The investigation, still ongoing as of August 11, is expected to clarify these points.

The Link to DEF CON 34

The flight carried many passengers returning from DEF CON 34, one of the largest hacker conventions in the world, which took place from August 6 to 9, 2026 at the Las Vegas Convention Center. The 2026 edition had the theme "Agency" and concluded on Sunday evening.

Although the precise attribution to DEF CON participants is not formally established — one of the comments under BleepingComputer's article rightly reminds that "we cannot even assert with certainty that they were a DEF CON participant" — Monika Hathaway, DEF CON’s press officer, provided a particularly revealing statement to CyberScoop:

“Our conference this year also suffered from several similar ‘deauthentication’ Wi-Fi attacks, and this affected some of our operations. If we had caught someone doing this at DEF CON, we would have expelled them and banned them from the conference.”

Hathaway specified that neither Delta nor federal authorities had contacted DEF CON regarding the incident.

Wi-Fi Pineapple and Consumer Tools

TechCrunch highlights that it is very easy to create a malicious Wi-Fi network using commercially available tools like the Wi-Fi Pineapple, a device sold by the company Hak5. Designed for professional penetration testing, this portable unit — powered by USB-C, equipped with multiple antennas, and starting at a few hundred dollars — allows for:

  • cloning preferred networks (rogue access point) via the "PineAP" suite;
  • capturing WPA/WPA2 handshakes and impersonating corporate access points;
  • conducting deauthentication attacks;
  • displaying captive portals to retrieve credentials and personal identifiable information (PII).

The manufacturer does specify, however, that the device is intended "for authorized audit and security analysis purposes only" and that users are "solely responsible for complying with local laws." No source has confirmed that the tool used aboard Flight 591 was indeed a Wi-Fi Pineapple.

Challenges and Precedents

This type of incident serves as a reminder that in-flight Wi-Fi remains a weak point: it is a shared network, often without strong link-level authentication, where passengers connect to a captive portal to access the Internet. Airlines typically use satellite communication systems (Viasat, Intelsat, Starlink, etc.) that feed an onboard access point, but the Wi-Fi coverage itself remains comparable to that of a public café.

Several elements distinguish this case from a simple “script kiddie” playing with aircrack-ng:

  • the attack occurred in mid-flight, in a regulated environment where any interference with the aircraft's systems is taken seriously;
  • the rogue network bore a name mimicking Delta ("Delta WiFi Fast"), suggesting an intent to spoof and phish rather than a simple technical demonstration;
  • a page collecting Google credentials was reported, bringing the incident closer to a credential theft operation potentially intended for reselling or subsequent access.

Legally, conducting such an operation without authorization aboard a commercial aircraft exposes its authors to prosecution under U.S. federal computer fraud laws (Computer Fraud and Abuse Act) and communications laws, as well as potentially aviation-related charges. The seizure of equipment upon arrival suggests that authorities are taking the matter seriously.

Key Takeaways

  • The incident never threatened flight safety or the navigation systems of the aircraft, as Delta has repeatedly emphasized.
  • The investigation is still ongoing as of August 12, 2026, conducted in conjunction with federal law enforcement and aviation regulators.
  • The FBI in Atlanta and the FAA are reportedly aware according to CyberScoop, even though TechCrunch reports that the FAA had not received a formal report at the time of publication.
  • DEF CON 34 itself experienced similar attacks during the event, according to its press officer.
  • The case illustrates the technical ease of this type of attack (deauth + evil twin) on public Wi-Fi networks, including on airplanes, and the importance for travelers not to enter sensitive credentials on a public Wi-Fi captive portal without network verification, and to prefer using a VPN.

The flight in question received no major French-language media coverage by August 12, 2026; this article relies on English sources published on August 11.