Manchester Airports Group Breach Exposes Data on 8.7 Million Customers

Manchester Airports Group (MAG), the UK’s largest airport operator, has confirmed that an unauthorised third party stole customer data covering roughly 8.7 million people across Manchester, London Stansted and East Midlands airports. Most of what was taken is email addresses, harvested from airport Wi-Fi sign-ups and from car park, lounge and Fast Track bookings.

That “mostly emails” framing is doing a lot of work in the coverage, and it is worth pushing on. An 8.7 million-record list of verified email addresses, each one tied to a named airport and a specific service a person actually used, is not a low-value breach. It is a phishing supply chain. This piece lays out what MAG has confirmed, what is still only claimed, and the concrete steps a defender or an affected traveller should take now.

Updated September 5, 2026: the extortion group published. FulcrumSec posted the stolen material on its leak site on September 3, and SecurityWeek reported that the released set carries email addresses and phone numbers for 8.8 million people, dumped after MAG declined to pay. Cybernews describes the published content as also including postcodes, vehicle registrations and future booking information. The refusal to pay, described further down this page as only “understood”, can now be firmed: MAG has acknowledged receiving a ransom demand and the group itself says it was not paid.

On the number: the roughly 8.7 million in this headline is MAG’s own count of affected customers, and it stands. The 8.8 million in the leak reporting is a count of records inside a criminal data set, supplied by the people who published it. Those two things are not necessarily in conflict, and only one of them has an accountable source behind it. Same caution on volume. The group now says the 86 GB it originally claimed was a compressed archive that extracts to somewhere between roughly 550 GB and 640 GB. Both ends of that range are attacker-supplied, so read it as hundreds of gigabytes and do not spend effort on the decimal point.

The claimed entry vector is the part defenders should read twice. FulcrumSec says it got in using airport-specific Iterable API credentials embedded in client-side JavaScript, which is to say credentials shipped to every visitor’s browser. That account was relayed by BleepingComputer and TechNadu. MAG has not confirmed it and Iterable has not commented, so it remains an attacker’s claim until someone with access to the forensics says otherwise. Two points of precision. This describes MAG’s own credentials for a third-party marketing engagement platform, exposed by MAG’s own website, and not a compromise of that platform. And I am naming the class of mistake only, not how anyone would go looking for it. One line is worth adding, without a victory lap: the analysis further down this page, written before any vector was known, argued that data like this “often sits in a marketing or engagement platform rather than the core booking system.” If the claim holds, that is where the door was.

That adds one item to the defender list below, and it is cheap. Enumerate the API keys your public web properties ship to the browser, then answer two questions for each: is it meant to be public, and is it scoped to something you would not mind a stranger doing? Marketing and analytics SDKs are the usual offenders, because they get added by teams that never route through security review. Run secret scanning against your front-end build output, not only against the repository. The phishing guidance below is unchanged in substance but has changed in state: the lure material is public now rather than held by one group, and it reportedly includes bookings that have not happened yet, which makes for a far more convincing message than a receipt for a trip already taken.

What MAG Confirmed

MAG disclosed the incident on August 27, 2026, saying an unauthorised third party had obtained a “quantity” of customer data from the three airports it operates. In its statement, the company said: “We immediately contained the risk and have been working with specialist advisors and taking appropriate steps to protect our customers and systems,” per Help Net Security, adding that passenger safety and aviation security were never compromised.

The exposed information came from car park, lounge and Fast Track bookings, plus registrations for in-airport Wi-Fi, The Record reported. According to MAG, the stolen records include email addresses, phone numbers, vehicle registrations and postcodes. The company was explicit that no financial data was involved: “Neither MAG nor the system accessed hold customers’ bank or payment details.” The figure of roughly 8.7 million affected customers was reported by UK outlets including the BBC, and the great majority of those people had only their email address exposed.

As a precaution, MAG switched off its online Manage My Booking portal. Anyone needing to change or cancel a booking in the next 72 hours has to phone customer services instead, and the company warned that wait times may run long. MAG says it has contacted affected customers directly and reported the incident to the relevant authorities.

Who Is Behind It, and Was There Ransomware?

This is where the confirmed record thins out, so treat the following as claim rather than fact. An extortion group calling itself FulcrumSec claimed responsibility to BleepingComputer, saying it exfiltrated roughly 86 GB of data and demanded a ransom that MAG is understood to have refused to pay. MAG has said it knows the identity of the threat actor but has not publicly named the group, so the FulcrumSec attribution is the attacker’s own claim, not a confirmation from MAG or a government agency.

A few things remain unestablished as of publication, and I am flagging them rather than papering over them. The threat-actor attribution is not officially confirmed. There is no public confirmation that this was a ransomware (file-encrypting) event as opposed to a data-theft-and-extortion one; the reporting describes stolen data and a ransom demand, which points to extortion rather than encryption, but MAG has not characterised it either way. The intrusion date and dwell time have not been disclosed. And FulcrumSec’s account of how it got in is an unverified attacker claim, so I am not repeating the technical specifics here.

My read: the “bank details were safe” reassurance, while true and worth stating, risks anchoring readers on the wrong risk. Wi-Fi-registration data is an under-appreciated breach surface. Airport Wi-Fi captive portals collect an email address in exchange for connectivity, the data often sits in a marketing or engagement platform rather than the core booking system, and it rarely gets the same scrutiny or retention discipline as payment infrastructure. Yet the output is a large, clean, context-rich contact list: this person used this specific airport’s Wi-Fi or parked here. That context is exactly what makes a phishing lure convincing. Payment cards can be reissued in days. A leaked email tied to a real travel behaviour is a durable targeting asset.

Why an “Email Only” Breach Still Matters

The defender lesson here is not about card fraud. It is about the quality of the phishing that this data enables. A generic scam email is easy to ignore. A message that correctly references the airport you flew from, the fact that you registered for its Wi-Fi, or a car park booking you actually made clears the credibility bar that most phishing fails at. Add a spoofed MAG or airport brand and a plausible pretext (confirm your booking, claim a parking refund, re-verify your account), and the click-through rate climbs.

MAG made the same point in defensive terms, warning that it “will never contact you unexpectedly to request payment card details, banking information, or passwords,” as Infosecurity Magazine noted. That is the right message. The follow-on risk is a wave of MAG-themed and airport-themed lures over the coming weeks, aimed at people who now have a real reason to expect contact from the company.

We have seen this pattern in aviation before. When Qantas disclosed a breach affecting 5.7 million people, the exposed contact data set up exactly this kind of downstream phishing risk, and the airline itself flagged impersonation attempts. The refuse-to-pay posture MAG is reported to have taken also echoes Berlin’s refusal to pay extortionists after a state-network intrusion. Not paying is defensible, but it does not reduce the exposure of data already taken, which is why customer-facing anti-phishing communication matters more than the ransom decision.

What Affected Travellers Should Watch For

If you have used Wi-Fi at Manchester, Stansted or East Midlands, or booked parking, a lounge or Fast Track, assume your email address is in the stolen set and calibrate accordingly. The checklist below is the practical version of MAG’s guidance.

What to watch for after the Manchester Airports Group breach. The Signal, from MAG’s customer guidance.

What Security Teams Should Do

For defenders outside MAG, the actionable work is on the receiving end of the phishing wave this data will feed:

• Tune detection for MAG and airport-brand lures. Add Manchester Airports Group, the three airport names and Manage My Booking to phishing-simulation and mail-filtering watchlists for the next several weeks. Newly registered lookalike domains around these brands are the ones to hunt for.
• Warn travelling staff specifically. If your workforce flies through these airports, a short heads-up beats a generic reminder. Tell them a real breach means real-looking follow-up, and that the airport will not ask for passwords or card details out of the blue.
• Treat exposed emails as a credential-stuffing input. A verified email list is raw material for account-takeover attempts elsewhere. Watch for unusual login patterns against corporate accounts sharing these addresses, and lean on multi-factor authentication.
• Revisit your own captive-portal and marketing-platform data. The broader lesson is retention discipline. Wi-Fi sign-up emails and marketing-engagement stores are easy to forget and easy to over-retain. Map where that data lives, minimise it, and hold it to the same standard as your core systems.
• Audit what your public site ships to the browser. Added September 5 in light of the claimed vector. Inventory every API key present in your client-side JavaScript, confirm each is intended to be public and scoped to harmless operations, and point secret scanning at your build output as well as your repository.

For a wider view of how disclosure and regulatory obligations play out after incidents like this, see our guide to data breach notification laws. The UK dimension here is not unique either; MAG is the latest UK operator in the firing line after cases such as the disruption at a UK power plant earlier this year.

Where This Goes Next

The open questions are the ones to track: whether MAG or the ICO publicly names the threat actor, whether the scope grows beyond email as investigators review the stolen set (early samples suggest more detail for some customers than the headline “mostly emails” implies), and whether the extortion group publishes the data after MAG’s reported refusal to pay. The regulatory thread runs through the Information Commissioner’s Office, which has confirmed it received a breach notification and is assessing what MAG has supplied.

Updated September 5, 2026. The third of those questions is now answered: the data was published on September 3. See the update at the top of this page. The ICO thread and the actor-naming question remain open.

Updated August 30, 2026. This is a developing story; we will revise as MAG, the ICO or the NCSC confirm further detail.

Primary Documents

• Help Net Security: Manchester Airports Group breached, millions of customers’ data stolen
• The Record: Cyberattack on Manchester Airports Group exposes millions’ customer info
• The Register: Cybercrooks jet off with Manchester Airports Group customer data
• Infosecurity Magazine: Manchester Airports Group hit by cyber incident
• BleepingComputer: FulcrumSec claims Manchester Airports hack (attacker claim, unverified)
• SecurityWeek: Manchester Airports Group data on 8.8 million people leaked after ransom refusal
• Cybernews: UK airport data breach, hackers publish nearly 9M traveller records

Nicholas Robert is founder and editor of The CyberSignal.