2026-08-28 · view entry permalink →
Manchester Airports Group confirms a breach touching roughly 8.7 million customers across Manchester, Stansted and East Midlands, car-park, lounge and airport-WiFi sign-up data taken; FulcrumSec later claims credit and a client-side API-credential access vector
Manchester Airports Group (MAG), operator of Manchester, London Stansted and East Midlands airports, confirmed on 2026-08-27 that "an unauthorised third party" obtained "a quantity of customer data" relating to car-park, lounge and Fast Track bookings and in-airport WiFi sign-ups (Manchester Airports Group, 2026-08-27). Roughly 8.7 million customers are affected, the large majority with only an email address exposed, collected during public-WiFi signup: "the overwhelming majority of those affected have only had their email addresses compromised" (The Register, 2026-08-27); a smaller subset also had phone numbers, vehicle registrations and postcodes taken.
MAG states neither it nor the accessed system holds bank or payment-card data, and that no operational or aviation-security system was touched: "at no point has passenger safety or aviation security been compromised" (Manchester Airports Group, 2026-08-27). The group temporarily suspended its online Manage My Booking service as a precaution (Infosecurity Magazine, 2026-08-27). The Register reports, attributed to the outlet, not confirmed by MAG's own statement, that the intrusion compromised one internal system and then pulled files from a third-party-hosted database, that the attacker's ransom demand was notably lower than the group's typical extortion demand and was not paid, and that MAG characterises the incident internally as "a hack, not a lapse." At the time of MAG's initial disclosure, no extortion group had claimed the incident publicly and no outlet had named an access vector, an exploited product, or a CVE, that changed three days later, when FulcrumSec claimed responsibility and named an access vector (see the 2026-08-31 update below). The Register reports that the Information Commissioner's Office "asked MAG not to share details of the ransom note, the extortion demands, or the group name" (The Register, 2026-08-27); no source states that the ICO has confirmed receiving a breach report, and MAG says only that it has "informed and are working with the relevant authorities" (Manchester Airports Group, 2026-08-27).
The access vector came later and from the attacker: FulcrumSec, which claimed the intrusion on 2026-08-30, says it used airport-specific marketing-platform API credentials exposed in client-side JavaScript, and it has since published the dataset (both set out in the updates below). No exploited product or CVE is named. The transferable point is scale rather than mechanism: 8.7 million records exposed through apparently low-sensitivity WiFi-signup collection shows how ancillary customer-facing services (guest WiFi, parking bookings) can carry disproportionate downstream exposure.
Manchester Airports group has been subject to a cyber security incident by an unauthorised third party. A quantity of customer data has been obtained that relates to car park, lounge and Fast Track bookings and in-airport WIFI sign-ups at Manchester, Stansted and East Midlands airports.
If you have been notified that you were affected by the incident, your data was made publicly available.
At no point has passenger safety or aviation security been compromised.
The overwhelming majority of those affected have only had their email addresses compromised.
The group claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript and that the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026.
MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, including reaching out to all those with upcoming bookings to advise them of additional support
Today we are releasing the Manchester Airports Group dataset: every customer, event, configuration that serves Manchester Airport, London Stansted and East Midlands Airport. Half a terabyte, and every byte of it is pure PII.
8,672,291 customer profiles with email, name, mobile, home town, postal region, and the residential IP address the account last connected from
approximately 8.8 million email addresses and phone numbers were compromised, alongside names, IP addresses, browser user-agent details, geographic information, purchases and vehicle registration plates
This entry stated that the UK Information Commissioner's Office had confirmed receipt of a breach report and was assessing it. No source cited here says that. MAG's own statement names no regulator, saying only that it has "informed and are working with the relevant authorities" (Manchester Airports Group, 2026-08-27), and the closest the reporting comes is The Register's account that the ICO "asked MAG not to share details of the ransom note, the extortion demands, or the group name" (The Register, 2026-08-27). The distinction matters for anyone reading this as a regulatory-timeline signal: engagement is on the record, a confirmed statutory filing is not.
The extortion group FulcrumSec claimed responsibility on 2026-08-30, telling BleepingComputer it stole approximately 86GB of data, considerably more than MAG's original disclosure suggested (BleepingComputer, 2026-08-30). The group says it obtained access using airport-specific Iterable (marketing-platform) API credentials exposed in client-side JavaScript (code that runs in the customer's own browser, so anyone inspecting network calls or page source could read the credentials) and claims the haul includes nearly 200,000 records tied to upcoming travel through the rest of 2026, alongside a roughly 21.5GB Manchester customer export combining identifiers, historical booking activity and marketing classifications. BleepingComputer validated one sample record against a real traveller's known purchase history, matching Fast Track bookings, arrival times, terminal and amounts paid, though it could not independently verify the claimed scope. MAG has not addressed the specific claims (the exposed credentials, the 86GB figure, the future-travel data) and continues to point to its existing customer-notification statement: "MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, including reaching out to all those with upcoming bookings to advise them of additional support" (BleepingComputer, 2026-08-30). No payment-card or banking data is reported exposed.
The exposure class this adds is distinct from the original disclosure: a third-party marketing or analytics SaaS API key embedded directly in browser-delivered JavaScript is effectively a public credential the moment the page is inspectable, independent of any server-side hardening. Organisations embedding third-party API keys client-side should verify with the vendor whether the key's scope can be restricted to write-only/track-only actions rather than full read access to customer records, and review outbound API call patterns from public web front-ends for tokens visible in bundled JS or the browser's network tab.
FulcrumSec has now published the full dataset rather than merely claiming it, and the confirmed scale is substantially larger than the ~86GB previously claimed: roughly 550GB uncompressed, comprising 8,672,291 customer profiles (email, name, mobile, home town, postal region, and the residential IP address the account last connected from), over 1.16 billion Iterable platform events (email sends, opens, clicks and bounces), 2,482,763 historical parking, lounge and Fast Track purchase records, 461,433 SMS messages containing booking date, car-park and vehicle-registration details in plain text, and roughly 108,000 distinct UK vehicle registration plates tied to owner contact and booking details (Security Affairs, 2026-09-04). Have I Been Pwned has processed the published dataset and added it to its breach database, confirming approximately 8.8 million unique email addresses and phone numbers alongside names, IP addresses, purchase history and vehicle registration plates. FulcrumSec's leak-site post separately claims the dataset includes government, judicial, military, police, NHS and defence-industry employees among the exposed customers, and that it withheld a subset of upcoming-travel records that would otherwise reveal when a victim's home will be empty; both claims are the extortion group's own framing and are not independently verified. No new access-vector information accompanies this development; the client-side API-credential vector already recorded above is unchanged.
The statement quoted at the top of this entry is MAG's spokesperson statement of 2026-08-27, carried verbatim on its media centre (Manchester Airports Group, 2026-08-27). The customer help page it was cited to has since been reworded in the past tense, and now also says that customers who were notified had their data "made publicly available" (Manchester Airports Group, 2026-08-27, revised since), MAG's own acknowledgement of the leak described in the update of 2026-09-05. The incident is also no longer unclaimed or without a stated vector: FulcrumSec's claim of 2026-08-30 supplied both.