Manchester Airports Group disclosed on 27 August that a cyberattack had affected the records of 8.7 million customers. The company operates Manchester, London Stansted and East Midlands, three of England’s busiest airports.
The attackers gained access through an Iterable application programming interface, or API, key that had remained unrotated in public-facing JavaScript code on all three airport websites since 2022.
The intrusion took place over the weekend of 22-23 August, 2026. MAG detected it on 25 August and said it notified customers and the ICO within 48 hours.
The data included email addresses, phone numbers, vehicle registration numbers and postcodes, as well as bookings for car parks, lounges and Fast Track services. It also included information from in-airport WiFi sign-ups.
FulcrumSec publicly claimed responsibility on 30 August through BleepingComputer. The group said it had obtained the key from the websites’ JavaScript code.
BleepingComputer checked one FulcrumSec record against a real traveller’s purchase history and found matching Fast Track bookings, arrival times, terminal information and payment amounts.
FulcrumSec leaked roughly 550GB of MAG data and demanded a ransom. It claims the material includes nearly 200,000 records linked to travel planned through the remainder of 2026.
MAG refused to pay. On 2 September, the attackers published the dataset and offered it to other criminals rather than continuing negotiations.
The company suspended its Manage My Booking service as a precaution, brought in external security experts and contained the breach. MAG said bank and payment details had not been stored, and flight operations were unaffected.
The breach came during peak summer travel. It put a large volume of customer information held under one operator at risk across three airports.
MAG is majority-owned by ten Greater Manchester local authorities. Australian fund IFM Investors has a minority stake.
It also followed other reported attacks on essential systems. Earlier in August, Iran-linked hackers were reported to have taken a British power plant offline for four days. A year earlier, a ransomware attack on Collins Aerospace’s check-in software had grounded systems at Heathrow, Brussels and Berlin.
Comments (0)