The data breach at Manchester Airports Group (MAG), the operator of Manchester, London Stansted and East Midlands airports, is one of the largest cybersecurity incidents in the UK transport sector in 2026. One month after it was discovered, the incident has entered a new phase: the data is no longer only in the attackers’ possession, but has been published in full and can be downloaded by anyone.
Below, we present the timeline of the incident, what data is currently exposed, how access was obtained, and what measures we recommend, both to people who have used the services of the three airports and to organisations that manage large volumes of customer data.
Incident timeline
25 August 2026. MAG detects unauthorised access to a database containing customer information, hosted by a third-party provider. The company isolates the incident, involves external security consultants and notifies the authorities.
27 August. Affected customers receive notifications, and MAG publishes a statement. The incident concerns approximately 8.7 million customers, and the data comes from parking, lounge and Fast Track bookings, as well as records from the airport Wi-Fi network. MAG states that payment data was not compromised and that flight operations were not affected. The company confirms that it received a ransom demand and that it did not pay.
30 August. The extortion group FulcrumSec claims responsibility for the attack and says it exfiltrated approximately 86 GB of compressed data.
2 September. Following the refusal to pay, FulcrumSec publishes approximately 550 GB of uncompressed data on its leak site, equivalent to around half a terabyte. On the same day, the dataset is processed and indexed by the Have I Been Pwned service, which records nearly 8.8 million affected email addresses.
Early media reports (including the source we used as the starting point for this material) described the situation as it stood on 27 August, when the data was only in the attackers’ possession. This assessment is no longer current. Once published, the data can be used by any malicious actor, not just the group that stole it.
What data is exposed
MAG’s initial communication mentioned four categories: email addresses, phone numbers, vehicle registration numbers and postcodes. Analysis of the published dataset shows a larger volume of information. According to Have I Been Pwned, the data includes names in plain text, email addresses, phone numbers, purchase history, vehicle registration numbers, IP addresses, browser information (user-agent) and geographical location.
FulcrumSec claims that the dataset contains approximately 2.48 million purchases (parking, lounge, Fast Track) and more than 108,000 unique vehicle registration numbers. The group also claims to have accessed approximately 190,000 bookings for trips scheduled after 1 September. These figures come from the attackers and have not been fully independently verified; nor could the group’s claim that it deleted some of the data relating to future trips be confirmed.
No card data was exposed. This reduces the risk of direct fraud, but does not eliminate the risk of social engineering: the combination of a name, contact details, vehicle registration number and booking history is sufficient for highly targeted phishing messages.
How access was obtained
According to FulcrumSec, gaining access did not require exploiting a vulnerability. The group claims that it found API administration keys for Iterable, the marketing and customer engagement platform used by MAG, embedded in the public JavaScript code of the websites of the three airports. Security researcher Scott Helme independently verified the claim and confirmed that the keys were visible in the page code and had not been rotated for more than four years.
From a technical perspective, this is the most relevant part of the incident. An API key exposed in the front end can be read by any visitor to the website. Requests made using a valid key appear in logs as legitimate traffic, so they do not trigger traditional intrusion detection alerts. The same platform also explains the presence of IP addresses and browser data in the published dataset: they originate from tracking pixels in marketing emails, not from the airports’ operational systems.
What this means for affected individuals
The main risk is personalised phishing via email, SMS or phone. A message such as “We are contacting you regarding your parking reservation at London Stansted, for the vehicle with registration number XYZ…” may include the recipient’s real name, real vehicle registration number and a service they actually used. All these details are now public, so their presence in a message no longer proves that the sender is legitimate.
Published data remains available over the long term and can be combined with information from other breaches. Therefore, the risk is not limited to the weeks immediately following the incident.
A recurring pattern in aviation
The MAG incident is not isolated. In January 2026, the Qilin ransomware group claimed an attack on Tulsa International Airport (USA) and published administrative files, employee credentials and internal financial documents. In April, the Nasir Security group claimed long-term access to the networks of Dubai International Airport and published, according to its own claims, passport photos and images from security checkpoints. In September 2025, the attack on Collins Aerospace’s check-in platform disrupted operations at Heathrow, Brussels and Berlin.
The common element is not the attack technique, but the entry point. None of these incidents targeted critical flight systems. All exploited secondary systems or third-party providers: marketing platforms, booking systems, Wi-Fi, administrative systems and credentials. An airport operates an ecosystem of dozens of providers, and each integration adds an attack surface. Responsibility for securing these integrations is often unclear between the operator and the provider.
Recommendations for passengers
Check whether your email address appears in the breach on haveibeenpwned.com. If you used parking, the lounge, Fast Track or Wi-Fi at Manchester, Stansted or East Midlands, assume that your data is stored.
Treat your name, email, phone number and vehicle registration number as public information. A message containing them is not, by itself, authentic.
Verify any request related to a booking through an independent channel: manually access the official website or call the number provided in the original confirmation, not the number included in the message.
Do not provide card details, passwords or authentication codes in response to an unexpected call, SMS or email. MAG has explicitly stated that it does not request such information.
Enable two-factor authentication on your email account, especially if the same address is used for important accounts.
For public Wi-Fi, forms and loyalty programmes, use a separate email address or alias that is different from your primary address.
In Romania, cybersecurity incidents and fraud attempts can be reported to the National Directorate for Cyber Security (DNSC), at 1911.
Recommendations for organisations
The MAG case shows that a large-scale breach does not necessarily require a sophisticated attack. The measures below address exactly the vectors involved here:
No secrets in client-side code. Automated secret scanning in the CI/CD pipeline and regular audits of published JavaScript bundles.
API keys with minimum privileges and periodic rotation. Keys used in the browser must be strictly limited; administrative keys must remain exclusively on the server.
Third-party provider inventory. Every SaaS platform that stores customer data must have an internal owner, documented access controls and contractual security clauses. In the context of NIS2, supply chain security is an obligation, not an option.
Data minimisation. Collect only what is necessary (for example, for Wi-Fi access) and establish clear retention periods.
API behaviour monitoring. Large exports or unusual request volumes should generate alerts, even when they are made using valid credentials.
Response plan for the “refusal, then publication” scenario. Refusing to pay the ransom is the standard recommendation, but organisations must be prepared for the publication of the data: updated communication with customers, cooperation with authorities and monitoring of data usage.
No legitimate institution will ask you to confirm banking details or passwords through an unexpected call, SMS or email. And the fact that a message knows your name and booking details is no longer, following this incident, a sign of trust.
Sources:
https://haveibeenpwned.com/Breach/ManchesterAirportsGroup
https://www.computerweekly.com/news/366649824/UK-airport-hackers-leak-stolen-customer-data
https://scotthelme.co.uk/no-hacking-required-manchester-airports-group-data-breach/
https://www.helpnetsecurity.com/2026/08/28/manchester-airports-group-data-breach/
