FBI warns travelers of 'Scattered Spiders' group targeting airlines

An early morning flight from Delta Air Lines leaves SFO. (Angelo DeSantis/Getty Images)

In the latest air travel news, the Federal Bureau of Investigation issued a public warning about a sophisticated criminal group that is hacking into the systems of major airlines; a research firm specializing in measurements of Wi-Fi performance speeds finds that a new provider of in-flight Wi-Fi is allowing much faster downloads than its competitors; the Supreme Court rejects American Airlines' effort to reconsider the lower courts' rejection of its Northeast Alliance with JetBlue; Delta adds another route from San Jose Mineta; United introduces a new transpacific destination; some transatlantic carriers are extending their summer seasonal routes into the winter, while others are cutting some winter flights; another carrier joins American Airlines' global Oneworld alliance. 

Airline passengers now have one more thing to worry about: the security of their personal information. The FBI issued a warning on social media that a sophisticated group of hackers is targeting the airline industry, putting its data - including customer information - at risk. The FBI said the hackers, known as Scattered Spider, use "social engineering techniques" like impersonating employees or contractors to convince the target company's IT help desks to grant them access to internal systems. "These techniques frequently involve methods to bypass multi-factor authentication (MFA), such as convincing help desk services to add unauthorized MFA devices to compromised accounts," the FBI said. "They target large corporations and their third-party IT providers, which means anyone in the airline ecosystem, including trusted vendors and contractors, could be at risk." Once they gain access, "Scattered Spider actors steal sensitive data for extortion and often deploy ransomware." 

The FBI warning was issued as airlines were hit by a series of cyberattacks in recent days, although it's unclear if the attacks could be traced to the Scattered Spider hackers.

A Hawaiian Airlines Airbus A320 departs from Harry Reid International Airport on March 15, 2025 in Las Vegas, Nevada. (Kevin Carter/Getty Images)

In mid-June, Canada's WestJet reported a cybersecurity incident involving its internal systems and its mobile app, "which has restricted access for several users." The airline stressed that its operations were not affected and that it immediately called in IT experts and law enforcement to protect company and passenger data. In its most recent update a week later, WestJet said it was still working to determine what kind of data may have been impacted by the hack.

Then, Hawaiian Airlines said last week it was "addressing a cybersecurity event that has affected some of our IT systems," but it gave no details about the incident or what kind of data was accessed. Hawaiian said its flight operations were not impacted, and that it was working with "the appropriate authorities and experts to assist in our investigation and remediation efforts."

On July 2, Qantas announced that it suffered a similar incident when "a cyber criminal targeted a call centre and gained access to a third party customer servicing platform." Qantas said the security breach has been contained and the incident never affected its flight operations. However, it acknowledged that the platform that was accessed by the cyber intrusion contained the records of six million customers. "We are continuing to investigate the proportion of the data that has been stolen, though we expect it will be significant," the airline said. "An initial review confirmed the data includes some customers' names, email addresses, phone numbers, birth dates and frequent flyer numbers." But Qantas noted that the data did not include credit card details, personal financial information or passport details. "No frequent flyer accounts were compromised nor have passwords, PIN numbers or log in details been accessed," it added.

A Delta Air Lines airbus at Los Angeles International Airport in October 2024. (Boarding1Now/Getty Images)

None of the affected airlines said anything about the Scattered Spider hacker group mentioned in the FBI's cybersecurity alert. But hacking incidents affecting four different airlines in just a few weeks seems more than coincidental. 

An iPhone connecting to Starlink internet on a Hawaiian Airlines flight in March 2024. (Angelo DeSantis/Getty Images)

Ookla, a company known for ranking the public Wi-Fi networks at major airports based on their download speeds, has extended its research to cover in-flight Wi-Fi, and its new report verifies what some fliers have been saying about Elon Musk's Starlink satellite network: It's better than other in-flight Wi-Fi services. Ookla tested the in-flight Wi-Fi on 30 U.S. and foreign airlines during the first quarter of 2025 and found the speediest downloads were on Hawaiian Airlines (with a median speed of 161 megabits per second) and Qatar Airways (120 mbps). Both of those airlines use Starlink, which has a network of more than 7,600 low-Earth orbit satellites providing full global coverage. The median download speeds at other U.S. carriers included in the study were 84 mbps for Spirit Airlines, 54 for Delta, 53 for Breeze, 50 for American, 33 for United, and 22 for JetBlue. (Note: United is in the process of installing Starlink across its fleet.) Ookla noted that despite performance improvements in recent years, "in-flight Wi-Fi for the majority of users compares very poorly with their experience on terrestrial networks."

BEST OF SFGATE

It's been two years since a federal district judge ordered the unraveling of American Airlines' Northeast Alliance with JetBlue, a partnership in which the two airlines coordinated schedules and shared revenues on routes out of the Boston and New York areas. The judge agreed with the Justice Department, which had sued to block the AA-JetBlue deal on antitrust grounds claiming it inhibited competition. JetBlue gave up on the partnership idea, but American never did, challenging the district court decision in a federal appellate court, which upheld the initial decision. American then appealed it the U.S. Supreme Court, which this week declined to take up the case, according to CNBC. American had been trying to keep open the possibility of entering similar agreements in the future, not to bring back the JetBlue deal. It's just as well that an American-JetBlue tie-up is now officially dead because in late May, JetBlue announced a new partnership with American's archrival United Airlines in which the two carriers will integrate their passenger loyalty programs and will swap some slots at New York JFK and Newark Liberty International airports, giving United its first access to JFK since 2022.

A Delta Air Lines airbus at San Jose Mineta International Airport. (SOPA Images/SOPA Images/LightRocket via Getty Images)

Delta expanded its presence at San Jose Mineta International two months ago by adding daily flights to Las Vegas, and next week it will expand again. On July 7, Delta will launch daily 737-900 service from SJC to its Detroit hub as a seasonal operation continuing through Nov. 30. Delta also flies from SJC to Atlanta, Los Angeles, Minneapolis-St. Paul, Salt Lake City and Seattle.

On the international side, United Airlines will add a new transpacific destination next week. The carrier already flies nonstop to Taipei, Taiwan from San Francisco twice a day, but on July 11 it will begin year-round service to Kaohsiung, Taiwan via a connection at Tokyo Narita. Kaohsiung is a city of 2.7 million on the southern end of Taiwan, while Taipei is on the northern tip. United will operate a 737-800 on the Tokyo-Kaohsiung segment. 

A Turkish Airlines plane takeoff from SFO in August 2024. (Anadolu/Anadolu via Getty Images)

As airlines work on adjustments to their winter schedules, some transatlantic carriers are extending their seasonal summer service while others are suspending flights during the slow season. TAP Air Portugal last month introduced a new summer route from Los Angeles International to Lisbon, but now the carrier has decided to keep flying it through the winter. According to Aeroroutes, TAP will offer LAX-Lisbon service three days a week from Oct. 26 to March 28, 2026, down from its summer schedule of four a week. Italy's ITA Airways suspended its LAX-Rome service last winter from mid-January through February, but for 2026 it will continue to fly the route four days a week from Jan. 16, 2026 through March 4, 2026. United Airlines will expand service to Ireland next winter, extending its Chicago O'Hare-Dublin route from a seasonal operation to year-round daily departures. 

Not all transatlantic routes are getting more capacity this winter, however. Simple Flying reports that Turkish Airlines is scaling back operations on some U.S. routes, including San Francisco. Turkish had been planning to operate 12 flights a week from SFO to Istanbul during November, but that's been reduced to 10 a week, and its December/January schedule is being trimmed from 14 weekly flights to 11. At Denver International, meanwhile, Air France has decided to convert its Denver-Paris CDG route from year-round to seasonal, suspending service from Oct. 13 to April 27, 2026, according to Aeroroutes. In Latin America, the Brazilian carrier Azul, which recently filed for Chapter 11 reorganization, plans to eliminate three routes out of Fort Lauderdale. Airline Geeks reports that Azul will end its Fort Lauderdale-Manaus, Brazil route on Aug. 9 and its service from FLL to Belo Horizonte, Brazil and to Curacao on Aug. 10.   

The American Airlines/Alaska Airlines/British Airways Oneworld global alliance has grown from 14 to 15 members following the addition of Oman Air this week. Based in Muscat, Oman, the new member carrier flies to 42 destinations in 22 countries. "As a full Oneworld member airline, Oman Air will provide Oneworld Emerald, Sapphire, and Ruby customers with benefits including earning and redeeming miles, earning status points, priority check-in and boarding and lounge access," the alliance said in a press release. "Likewise, Oman Air's top tier customers will gain access to Oneworld priority benefits including a network of nearly 700 premium airport lounges globally, as well as newly opened Oneworld branded lounges in Amsterdam's Schiphol and Seoul's Incheon Airports."

More Travel