Delta Air Lines Flight 591, Las Vegas to Atlanta, 10 August 2026. A Boeing 757 with 199 passengers and 6 crew, many of them returning from DEF CON 34.

Somewhere over the middle of the country, a network appeared called "Delta WiFi Fast", serving a page that collected personal credentials and Google login data.

Cabin crew found it and disabled the aircraft's Wi-Fi for about 30 minutes. The detail arrived through ACARS, the aircraft's own text messaging system, which is how the crew was communicating about it in flight.

Delta's statement:

One initial finding is an unauthorized WiFi network, which was not provided, operated, or supplied by Delta, was present onboard.

No emergency was declared with air traffic control. Federal authorities and airport police boarded on landing, questioned suspects and seized portable Wi-Fi equipment.

What a deauth attack is, and why it matters here

A deauthentication attack forges packets that impersonate a legitimate access point and tell connected clients to disconnect. Keep sending them and devices stay off the real network.

On its own that is a nuisance. The reason it is done is the next step: a device knocked off the network will look for another one, and a rogue access point with a plausible name is waiting. That is how you move someone from the airline's Wi-Fi to yours, and from yours to a login page.

"Delta WiFi Fast" is a good name. It is close enough to be believed and different enough to look like an upgrade.

The part that is genuinely serious

Cabin Wi-Fi is not connected to avionics. Aircraft networks are segregated, and nothing here suggests flight systems were reachable. That needs saying plainly, because "hackers attack plane" invites a conclusion the facts do not support.

What was at risk was 199 people's credentials, on a captive network they had no way to verify, at 35,000 feet with no alternative connection and no way to walk away.

That is the actual severity: a Wi-Fi network is a trust decision, and an aircraft is the environment where a passenger has the least ability to make that decision well. There is no second network to switch to and no cell service to check against.

The DEF CON context cuts both ways

The obvious reading is that someone came from a hacking conference and did this for fun. That may be right and nobody has been charged.

The less obvious reading is that this flight is close to the worst possible target. A plane full of DEF CON attendees is a plane full of people who will notice a rogue AP, screenshot it, and hand it to the crew. The attack was found quickly for exactly that reason.

If the same thing ran on an ordinary Tuesday flight to Atlanta, it is not clear anyone would have said anything.

What a traveller can actually do

  • Do not enter a Google or Microsoft login on an in-flight captive portal. The airline's own portal never needs one.
  • Turn off auto-join for open networks. This is the single setting that defeats the whole technique, and it is off by default on almost nobody's phone.
  • Use a VPN on any public Wi-Fi, but understand its limit: a VPN protects the traffic, not the credential you typed into a phishing page before it came up.
  • Treat a network you did not expect as hostile, particularly one with a name that is nearly right.

For anyone running a network rather than using one: this is 802.11 working as designed. Management frames are unauthenticated unless 802.11w protected management frames are enabled, and on a lot of deployed hardware they still are not.