Manchester Airports Group breach exposes 8.7 million customers

On 27 August 2026, Manchester Airports Group (MAG) — the UK operator of Manchester, London Stansted and East Midlands airports — disclosed that an unauthorized third party had obtained customer data held by systems supporting its car-park, lounge, Fast Track and in-airport Wi-Fi services. Reporting citing the company placed the affected population at around 8.7 million customers.

The compromised information could include email addresses, telephone numbers, postal codes and vehicle registration numbers used for those ancillary services. MAG emphasized that neither it nor the accessed systems held customers' bank or payment card details, and that at no point had passenger safety or aviation security been affected. The company said it had moved quickly to contain the risk and was working with specialist advisers and the relevant authorities.

What happened

The incident was subsequently claimed by a group calling itself FulcrumSec, which published email addresses and phone numbers it linked to the breach. According to security analysis, the attackers said they had simply extracted an API key exposed in the website's JavaScript — an access-control failure rather than a sophisticated intrusion — and used it to pull customer records at scale.

Why it matters

The MAG breach shows how much sensitive personal data now sits in the peripheral digital services around an airport — parking, lounges, Wi-Fi — rather than in core operational systems. It is also a stark reminder that hardcoded secrets exposed in client-side code remain one of the most common and preventable causes of large-scale data exposure, allowing millions of records to be scraped without breaching the core network.