Manchester Airports Group Confirms Data Breach Affecting 8.8 Million Customers
Manchester Airports Group (MAG), which operates Manchester, London Stansted, and East Midlands airports, has confirmed a data breach that has compromised customer information stored in a third-party database. The company stated that airport operations, passenger safety, and aviation security were not impacted by the breach. However, the incident has exposed data that could facilitate fraudulent activities.
The breach involved data related to parking, lounge, and Fast Track bookings, as well as airport Wi-Fi sign-ups. MAG reported that attackers accessed email addresses, phone numbers, vehicle registration details, and postcodes, but confirmed that payment card data was not accessed.
The incident was disclosed on August 27, and MAG indicated that it had contained the risk, engaged specialist advisers, and notified relevant authorities. The extortion group FulcrumSec claimed responsibility for the breach and leaked the data after MAG refused to meet its ransom demands.
FulcrumSec announced on its data leak site that it was releasing a dataset from MAG, which it described as containing every customer, event, and configuration related to the three airports. The group claimed that the breach was facilitated by exposed administrator keys found in the frontend JavaScript of the airports' websites, allowing access to millions of passenger records. MAG has not confirmed these claims, and independent verification has not been conducted.
The leaked data reportedly includes 190,849 future bookings, with 142,755 linked to vehicle registrations, potentially revealing when homes will be unoccupied. Additionally, the data includes information about thousands of government, judicial, military, police, NHS, and defense-industry employees, raising significant security concerns. FulcrumSec stated that it had withheld the most sensitive travel details before publishing the data, while accusing MAG of downplaying the breach's severity.
The breach has been added to the Have I Been Pwned database, which allows users to check if their email addresses are included in the leaked dataset. The service reports that approximately 8.8 million email addresses and phone numbers were compromised, along with names, IP addresses, browser user-agent details, geographic information, purchases, and vehicle registration plates.
This breach presents a serious risk for those who have used MAG's parking, lounge, Fast Track, or airport Wi-Fi services. Affected individuals should be vigilant for phishing attempts that may become more targeted and should take precautions such as changing passwords, enabling multi-factor authentication, and reviewing account-recovery methods. Legitimate organizations will not request sensitive information like passwords or banking details via email or phone, and users are advised to access relevant services directly rather than through links in unsolicited messages.
