Manchester Airports Group (MAG) data allegedly leaked by FulcrumSec exposes emails and phone numbers of 8.8 million people.

Manchester Airports Group, which operates Manchester, London Stansted and East Midlands airports, has confirmed a data breach involving customer information held in a third-party database. The company says airport operations, passenger safety and aviation security were not affected, but the incident has exposed data that can make fraud far more convincing.

The data related to parking, lounge and Fast Track bookings, as well as airport Wi-Fi sign-ups. MAG said attackers took email addresses, phone numbers, vehicle registration details and postcodes, while payment-card data was not accessed.

The group disclosed the incident on 27 August and said it had contained the risk, engaged specialist advisers and notified relevant authorities.

The extortion group FulcrumSec claimed responsibility for the intrusion and leaked the data after MAG had refused its ransom demand.

“Today we are releasing the Manchester Airports Group dataset: every customer, event, configuration that serves Manchester Airport, London Stansted and East Midlands Airport. Half a terabyte, and every byte of it is pure PII. However, we have decided to withhold the most dangerous part of the breach : the nearly 200,000 passengers whose entire upcoming travel schedules were exposed by MAG’s negligence, which, when linked with their full PII and vehicle information, creates an ideal opportunity for burglars, stalkers, and worse.” FulcrumSec wrote on its data leak site. “Unfortunately for them, MAG made zero effort to protect all their data they’d been collecting. The way we gained access was so simple it is tragi-comical: Iterable admin keys in the frontend JavaScript of each of its three airports’ websites: manchesterairport.co.uk, stanstedairport.com, and eastmidlandsairport.com. Each site had its own key hardcoded into it that provided access to millions of passengers who had passed through that airport. That means for this breach to have occurred at the scale it did, MAG had to make a catastrophic security mistake not once, not twice, but THREE times.”

FulcrumSec claims it accessed MAG’s systems using administrator keys exposed in the JavaScript of its three airport websites. MAG hasn’t confirmed this, and SecurityWeek hasn’t independently verified it, so the claim remains unproven. Still, the case highlights a basic security rule: keep secrets off client-side code, rotate them regularly, limit access and scan code, repositories, logs and configurations for accidental exposure.

The group then published roughly 550 GB of uncompressed data it says came from the airport operator’s systems.

“These exposed keys gave us access to the following:

• 8,672,291 customer profiles with email, name, mobile, home town, postal region, and the residential IP address the account last connected from
• 1,169,302,811 events, of which 1,160,120,195 are email-channel events: 611,629,550 sends, 463,286,223 opens, 36,878,965 clicks, plus every subscribe, unsubscribe, bounce and complaint
• 2,482,763 purchases — every booking every customer of its parking, lounge, and fast-track products has ever made. An analysed subset of 1,154,675 transactions, from 877,754 identified purchasers, totals £83,413,317.89
• 461,433 SMS messages rendered with a passenger’s booking date, car park and vehicle registration spelled out in plain text
• 108,077 unique UK vehicle registration plates tied to the owner’s email, mobile, airport, car park and dated booking
• The complete platform configuration: every campaign, every journey, every list, every segment and every template, all as live JSON” FulcrumSec added.

The announcement claims that a leaked MAG database exposes 190,849 future bookings, including 142,755 linked to vehicle registrations, potentially revealing when homes will be empty.

It also claims the data includes thousands of government, judicial, military, police, NHS and defence-industry employees, creating significant security risks. The attackers say they removed the most sensitive travel details before publishing, while accusing MAG of downplaying the breach.

Databreach notification service Have I Been Pwned processed the available dataset and added the incident to its breach database. The service reports that approximately 8.8 million email addresses and phone numbers were compromised, alongside names, IP addresses, browser user-agent details, geographic information, purchases and vehicle registration plates.

That is not just a list of email addresses. It is a working fraud kit: a criminal can link a person to an airport, a booking type, a car, a location and a contact number. They don’t need to guess much after that.

What affected people should do

Anyone who has used MAG’s parking, lounge, Fast Track or airport Wi-Fi services should assume that phishing attempts may become more tailored. They should be cautious with messages claiming to concern a booking, refund, parking penalty, account problem or payment request.

Users should change passwords if they reused one associated with these services elsewhere, especially on email accounts. They should also enable multi-factor authentication, review account-recovery methods and avoid clicking links in unexpected messages.

A legitimate organisation will not ask for a password, a banking PIN or a one-time authentication code by email, SMS or phone. If a message refers to a booking, open the relevant airport or provider site manually rather than following the link it contains.

The Have I Been Pwned breach entry allows users to check whether their email address appears in the published dataset.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Manchester Airports Group)

Extortion group FulcrumSec claims they stole 86GB of Manchester Airports Group data after finding API credentials exposed in client-side JavaScript.

Manchester Airports Group (MAG) disclosed a data breach on August 27 affecting customers of Manchester, London Stansted, and East Midlands airports. Two days later, BleepingComputer reports the extortion group FulcrumSec claimed responsibility, saying it stole roughly 86GB of data, considerably more detailed than what MAG’s original disclosure suggested.

MAG’s own statement describes a relatively limited set of exposed data. It says the breach affected car park, lounge, Fast Track bookings, and airport WiFi registrations, exposing email addresses, phone numbers, vehicle registrations, and postcodes.

MAG disclosed that the data breach impacted 8.7 million customers, however, the company says most of those customers had only their email addresses exposed.

FulcrumSec tells a different story. The group shared samples with BleepingComputer that included a 21.5GB export of Manchester customer data, with personal identifiers, historical booking details, and marketing information. BleepingComputer checked one record against a real traveler’s purchase history and found matching Fast Track bookings, arrival times, terminal information, and payment amounts.

The alleged way into the system is particularly concerning. FulcrumSec says it found airport-specific Iterable API credentials inside client-side JavaScript. That code runs in users’ browsers, so anyone inspecting the website with developer tools could potentially see those credentials.

“The group claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript and that the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026.” states the report. These records allegedly contain dates, times and booking information linked to personally identifiable information. FulcrumSec says it intends to publish the stolen data and a technical account of the intrusion. If the claim is accurate, attackers did not need a highly sophisticated technique. They simply found sensitive API credentials exposed in code that the website sent directly to customers’ browsers.”

The most concerning specific claim is nearly 200,000 records tied to upcoming travel through the rest of 2026, complete with dates, times, and booking details linked to identifiable individuals. BleepingComputer couldn’t independently verify that number or the full scope of what was actually taken, and MAG declined to directly address FulcrumSec’s specific claims when asked, instead pointing to its existing statement that affected customers with upcoming bookings had already been contacted. MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, a spokesperson said, without engaging with the 86GB figure or the exposed-credentials claim directly.

FulcrumSec plans to publish the stolen data but may redact upcoming travel records because of the risk of real-world harm. UK postcodes can identify very small groups of addresses, and combined with vehicle registrations, parking dates and booking details, the data could enable highly convincing phishing messages targeting people with upcoming trips.

UK postcodes make this exposure sharper than the equivalent breach might be in the US. Unlike American ZIP codes covering broad delivery areas, a full UK postcode typically identifies a small cluster of neighboring addresses, sometimes a single property, according to the Office for National Statistics. Combined with vehicle registrations, parking dates, and specific booking references, that’s more than enough raw material for a phishing message referencing a real upcoming trip that would be very hard to distinguish from a genuine MAG communication.

Security researchers commenting on the broader incident have flagged a supply-chain angle worth watching. Airport operations increasingly run through third-party platforms for booking, parking, and loyalty services rather than systems the airport itself directly controls, and Iterable, the marketing platform whose API credentials FulcrumSec claims to have abused, is exactly that kind of outsourced dependency. This also isn’t aviation’s first bad year: a September 2025 ransomware attack on Collins Aerospace‘s check-in software had already grounded systems at Heathrow, Brussels, and Berlin, meaning UK and European aviation infrastructure has now taken two significant hits inside twelve months.

MAG says no payment card or banking data was exposed, however, travelers who recently booked parking, lounge access or Fast Track should assume more travel data may be exposed and treat messages citing real booking details with caution.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Manchester Airports Group (MAG))

A cyberattack on Manchester Airports Group exposed data of 8.7 million customers across Manchester, Stansted, and East Midlands airports.

Manchester Airports Group disclosed that an unauthorised third party accessed customer data belonging to approximately 8.7 million people across three of England’s busiest airports: Manchester, London Stansted, and East Midlands.

“Manchester, London Stansted and East Midlands airports have been hit by a cyber-attack in which hackers accessed the data of about 8.7 million customers.” reads the report published by The Guardian.

“The incident involved data related to “car park, lounge and fast-track bookings and in-airport wifi sign-ups”, and the hackers obtained email addresses, phone numbers, vehicle registration numbers and postcodes, said Manchester Airports Group (MAG), which operates the three hubs.”

MAG says it learned about the incident on Tuesday, August 25, after attackers breached the system over the weekend.

The affected data included car park bookings, lounge and fast-track security reservations, and airport Wi-Fi sign-ups. Attackers accessed email addresses, phone numbers, vehicle registration numbers, and postcodes. The system did not store bank or payment details. According to MAG, most of the 8.7 million affected customers only lost their email addresses, while the impact varies depending on which services they used.

The attack did not disrupt airport operations or flights. As a precaution, MAG temporarily suspended its Manage My Booking service, but all existing reservations remain valid. Customers who need to change a booking within the next 72 hours can use a dedicated phone line.

“We would urge you to be particularly cautious of unexpected emails, calls or text messages claiming to be from us. We will never contact you unexpectedly to ask for payment or banking information. We apologise for any inconvenience or concern this may cause.” reads the email sent by Stansted to affected customers.

That warning is relevant because the combination of an email address, a phone number, and the knowledge that someone recently made a parking or lounge booking gives a convincing starting point for a targeted phishing message. Attackers don’t need payment data if they can impersonate the airport convincingly enough to obtain it themselves.

The timing adds pressure. The attack landed during the peak summer travel season, with millions of families flying back into the UK before the school year begins. The three airports combined handled around 54 million passengers last year, and MAG recently reported a record 66 million passengers across its network. The scale of the data exposure reflects the sheer volume of ancillary services these airports sell, and how much personal data those services routinely collect.

The wifi registration system is the detail worth noting: signing into airport wifi typically requires a name, email, and phone number at minimum, and that information now belongs to whoever executed this breach.

MAG says it quickly contained the incident, brought in external cybersecurity experts and notified the relevant authorities. No group has claimed responsibility, and investigators have not publicly linked the attack to any specific actor.

The incident adds to a growing list of cyberattacks against UK infrastructure. Earlier in August, Iran-linked hackers took a British power plant offline for four days, marking the first confirmed case of Iranian actors shutting down a UK generator. Last year, attacks disrupted production at Jaguar Land Rover and targeted Marks & Spencer, Harrods and the Co-op. Heathrow also faced flight delays and cancellations after attackers disrupted check-in and boarding systems used by several European airports.

MAG’s breach adds further pressure on UK infrastructure operators to strengthen their cyber defenses.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, UK Airport Operator MAG)