A rogue Wi-Fi hotspot on a Delta flight has the FBI asking questions

A passenger aboard Delta flight 591 from Las Vegas to Atlanta allegedly ran a fake Wi-Fi hotspot mimicking the plane's real network on August 10, CyberScoop reported, triggering an FBI inquiry and renewed attention on how easy it still is to spoof onboard connectivity.

Crew aboard the Boeing 757, carrying roughly 199 passengers and six crew members, sent ACARS messages describing a rogue network named "Delta WiFi Fast" that appeared designed to capture logins rather than just provide connectivity. One passenger, Mary Perrault, told BleepingComputer the network's captive portal appeared to be collecting personal credentials and Google login data, a pattern consistent with an evil-twin access point cloning the legitimate network's name and prompting travelers to sign in. Some reporting also describes a deauthentication attack, forged signals designed to knock devices off the real network so they reconnect to the fake one instead. Delta disabled the aircraft's Wi-Fi for roughly 30 minutes as a precaution.

Delta says the incident never touched its own systems. "Safety of flight was never in question, and no aircraft operating systems were affected," a Delta spokesperson said, adding the unauthorized network "was not provided, operated, or supplied by Delta."

“FBI Atlanta is aware of reports regarding a potential Wi-Fi-related incident involving Delta Flight 591. We are in contact with our local and corporate partners on this matter. We have no additional information to provide at this time.”

— Tony Thomas, Spokesperson, FBI Atlanta

The DEF CON connection driving the headlines rests on timing and a single line in the crew's ACARS traffic, not on any confirmed law enforcement finding. The flight departed one day after DEF CON 34 wrapped at the Las Vegas Convention Center, and crew messages referenced "a cyber conference in Las" whose attendees were believed capable of jamming the aircraft's Wi-Fi. No named suspect, arrest, or seized device has been confirmed by Delta, the FBI, or DEF CON itself.

“Delta nor any federal authorities have reached out about the incident.”

— Monika Hathaway, Head of Press, DEF CON

• Flight: Delta 591, Boeing 757, Las Vegas to Atlanta, departed August 10, 2026
• Rogue network "Delta WiFi Fast" allegedly collected credentials via a captive portal; Wi-Fi disabled for ~30 minutes
• FBI Atlanta, FAA, and TSA all confirmed awareness; no arrest or named suspect has been confirmed by any party
• DEF CON 34 ran August 6-9 at the Las Vegas Convention Center; the conference itself says no one has contacted it about the incident

The incident lands in a stretch where attackers keep finding new angles on old social-engineering tricks. Phone-scam crews have started targeting Wall Street's biggest firms directly, and separately, researchers have flagged how AI tools are compressing the response window between a flaw being found and being fixed. An evil-twin Wi-Fi network at 30,000 feet needs none of that sophistication, just proximity, a familiar-sounding name, and passengers who don't think twice before logging in. Airlines have flagged similar rogue-hotspot attempts before, but rarely with this much visibility, since the only reason the public saw it at all was a hobbyist ACARS-tracking account posting the crew's internal messages in near real time.

This article is for informational purposes only and does not constitute investment advice.