2026-08-28 · view entry permalink →
Manchester Airports Group confirms a breach touching roughly 8.7 million customers across Manchester, Stansted and East Midlands, car-park, lounge and airport-WiFi sign-up data taken; FulcrumSec later claims credit and a client-side API-credential access vector
Manchester Airports Group (MAG), operator of Manchester, London Stansted and East Midlands airports, confirmed on 2026-08-27 that "an unauthorised third party" obtained "a quantity of customer data" relating to car-park, lounge and Fast Track bookings and in-airport WiFi sign-ups (Manchester Airports Group, 2026-08-27). Roughly 8.7 million customers are affected, the large majority with only an email address exposed, collected during public-WiFi signup: "the overwhelming majority of those affected have only had their email addresses compromised" (The Register, 2026-08-27); a smaller subset also had phone numbers, vehicle registrations and postcodes taken.
MAG states neither it nor the accessed system holds bank or payment-card data, and that no operational or aviation-security system was touched: "at no point has passenger safety or aviation security been compromised" (Manchester Airports Group, 2026-08-27). The group has suspended its Manage My Booking self-service portal as a precaution while investigating. The Register reports, attributed to the outlet, not confirmed by MAG's own statement, that the intrusion compromised one internal system and then pulled files from a third-party-hosted database, that the attacker's ransom demand was notably lower than the group's typical extortion demand and was not paid, and that MAG characterises the incident internally as "a hack, not a lapse." At the time of MAG's initial disclosure, no extortion group had claimed the incident publicly and no outlet had named an access vector, an exploited product, or a CVE, that changed three days later, when FulcrumSec claimed responsibility and named an access vector (see the 2026-08-31 update below). The Register reports that the Information Commissioner's Office "asked MAG not to share details of the ransom note, the extortion demands, or the group name" (The Register, 2026-08-27); no source states that the ICO has confirmed receiving a breach report, and MAG says only that it has "informed and are working with the relevant authorities".
No source states an access vector, exploited product or CVE, and no extortion actor has claimed responsibility; per The Register's reporting the data was obtained from an internal system and a third-party-hosted database. The transferable point is scale rather than mechanism: 8.7 million records exposed through apparently low-sensitivity WiFi-signup collection shows how ancillary customer-facing services (guest WiFi, parking bookings) can carry disproportionate downstream exposure.
Manchester Airports group has been subject to a cyber security incident by an unauthorised third party. A quantity of customer data has been obtained that relates to car park, lounge and Fast Track bookings and in-airport WIFI sign-ups at Manchester, Stansted, and East Midlands airports.
At no point has passenger safety or aviation security been compromised.
The overwhelming majority of those affected have only had their email addresses compromised.
The group claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript and that the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026.
MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, including reaching out to all those with upcoming bookings to advise them of additional support
Today we are releasing the Manchester Airports Group dataset: every customer, event, configuration that serves Manchester Airport, London Stansted and East Midlands Airport. Half a terabyte, and every byte of it is pure PII.
8,672,291 customer profiles with email, name, mobile, home town, postal region, and the residential IP address the account last connected from
approximately 8.8 million email addresses and phone numbers were compromised, alongside names, IP addresses, browser user-agent details, geographic information, purchases and vehicle registration plates
This entry stated that the UK Information Commissioner's Office had confirmed receipt of a breach report and was assessing it. No source cited here says that. MAG's own statement names no regulator, saying only that it has "informed and are working with the relevant authorities" (Manchester Airports Group, 2026-08-27), and the closest the reporting comes is The Register's account that the ICO "asked MAG not to share details of the ransom note, the extortion demands, or the group name" (The Register, 2026-08-27). The distinction matters for anyone reading this as a regulatory-timeline signal: engagement is on the record, a confirmed statutory filing is not.
The extortion group FulcrumSec claimed responsibility on 2026-08-30, telling BleepingComputer it stole approximately 86GB of data, considerably more than MAG's original disclosure suggested (BleepingComputer, 2026-08-30). The group says it obtained access using airport-specific Iterable (marketing-platform) API credentials exposed in client-side JavaScript (code that runs in the customer's own browser, so anyone inspecting network calls or page source could read the credentials) and claims the haul includes nearly 200,000 records tied to upcoming travel through the rest of 2026, alongside a roughly 21.5GB Manchester customer export combining identifiers, historical booking activity and marketing classifications. BleepingComputer validated one sample record against a real traveller's known purchase history, matching Fast Track bookings, arrival times, terminal and amounts paid, though it could not independently verify the claimed scope. MAG has not addressed the specific claims (the exposed credentials, the 86GB figure, the future-travel data) and continues to point to its existing customer-notification statement: "MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, including reaching out to all those with upcoming bookings to advise them of additional support" (BleepingComputer, 2026-08-30). No payment-card or banking data is reported exposed.
The exposure class this adds is distinct from the original disclosure: a third-party marketing or analytics SaaS API key embedded directly in browser-delivered JavaScript is effectively a public credential the moment the page is inspectable, independent of any server-side hardening. Organisations embedding third-party API keys client-side should verify with the vendor whether the key's scope can be restricted to write-only/track-only actions rather than full read access to customer records, and review outbound API call patterns from public web front-ends for tokens visible in bundled JS or the browser's network tab.
FulcrumSec has now published the full dataset rather than merely claiming it, and the confirmed scale is substantially larger than the ~86GB previously claimed: roughly 550GB uncompressed, comprising 8,672,291 customer profiles (email, name, mobile, home town, postal region, and the residential IP address the account last connected from), over 1.16 billion Iterable platform events (email sends, opens, clicks and bounces), 2,482,763 historical parking, lounge and Fast Track purchase records, 461,433 SMS messages containing booking date, car-park and vehicle-registration details in plain text, and roughly 108,000 distinct UK vehicle registration plates tied to owner contact and booking details (Security Affairs, 2026-09-04). Have I Been Pwned has processed the published dataset and added it to its breach database, confirming approximately 8.8 million unique email addresses and phone numbers alongside names, IP addresses, purchase history and vehicle registration plates. FulcrumSec's leak-site post separately claims the dataset includes government, judicial, military, police, NHS and defence-industry employees among the exposed customers, and that it withheld a subset of upcoming-travel records that would otherwise reveal when a victim's home will be empty; both claims are the extortion group's own framing and are not independently verified. No new access-vector information accompanies this development; the client-side API-credential vector already recorded above is unchanged.