Belgian who hacked American Airlines website avoids trial in the U.S.

Italy has frozen the extradition of a Belgian hacker to the United States. The 28-year-old male from Mechelen, Belgium, hacked the website of American Airlines (AA) and faced a possible trial in Texas, United States. Instead, next Wednesday, his case will be opened in Mechelen, where he can get a punishment of up to 5 years (versus 22 years in the United States). 

Belgian lawyers will represent Kevin D. before a Belgian court where he faces charges of communication fraud (up to 2 years imprisonment) and external hacking (up to 5 years). Still locked up in San Vittore, Milan, Italy, he anxiously awaits his trial.

The story dates back to Summer 2017 when American Airlines discovered that an unknown person was able to hack their systems. The FBI was able to trace him down to his modest house in Mechelen, Belgium. Kevin D. was able to purchase 10 business class tickets without paying. However, without using them.

He was also able to join the Admirals Club, the airline’s frequent flyer programme, enabling him to enter tens of lounges operated by AA. Next to buying 112,000 USD worth of aeroplane tickets, he also retrieved personal data, SOP’s and manuals.

American Airlines estimates a total loss of more than 203,000 USD and asked the Belgian judicial department to extradite the hacker. Belgium, however, refused to extradite the compatriot but didn’t inform Kevin D. about the request. In October last year, his father invited him to a football game in Italy but during the night after the game, police arrested Kevin D. in his hotel room. Hotels in Italy are legally obliged to provide guest information to police and juridical departments, hence the arrest warrant got activated.

Back in June, the parents visited Kevin D. for the first time since his arrest. They were impressed by the poor health condition of their son: he lost 25 kilogrammes and his skin was full of rash. Kevin’s father, devastated with anxiety and sadness, died from a heart attack a few days after his return from Italy.

Next Wednesday, Kevin D. will face trial in Mechelen. Hoping to return to Belgium as soon as possible to be with his mother.

In 2020, Kevin D. hacked the website of Brussels Airlines where he bought business class tickets worth 31,089 EUR. Only two tickets were actually used, he gave them away to some online friends. The judge suspended his punishment, but he had to pay the airline a compensation of 12,000 EUR.

At the age of 12, he hacked the website of Utopolis (cinema) in Belgium, making the system believe that the movie hall was sold out. He could go and watch a movie with a friend without other visitors.