Manchester Airports Group (MAG) has confirmed a data breach affecting customer information stored in a third-party database, leading to the exposure of personal details for approximately 8.8 million individuals. The incident, which MAG disclosed on August 27, involved data related to parking, lounge, and Fast Track bookings, as well as airport Wi-Fi sign-ups.
The compromised data includes email addresses, phone numbers, vehicle registration details, and postcodes. MAG stated that payment card data was not accessed and that airport operations, passenger safety, and aviation security remained unaffected. The company has engaged specialist advisers and notified relevant authorities.
The extortion group FulcrumSec claimed responsibility for the intrusion, stating they leaked the data after MAG refused their ransom demand. FulcrumSec published roughly 550 GB of uncompressed data, which they assert came from MAG's systems. The group claims to have accessed MAG's systems through administrator keys exposed in the frontend JavaScript of its three airport websites: manchesterairport.co.uk, stanstedairport.com, and eastmidlandsairport.com. Each site allegedly had its own hardcoded key, providing access to millions of passenger records. MAG has not confirmed this specific method of access.
According to FulcrumSec, the leaked dataset contains 8,672,291 customer profiles with email, name, mobile, home town, postal region, and the residential IP address from which accounts last connected. It also includes 1,169,302,811 "events," predominantly email-channel events such as sends, opens, and clicks, along with subscribe, unsubscribe, bounce, and complaint records. The group further claims the data includes 2,482,763 purchases, encompassing every booking for parking, lounge, and fast-track products, with an analyzed subset of 1,154,675 transactions totaling over £83 million. Additionally, 461,433 SMS messages, rendered with passenger booking dates, car park details, and vehicle registrations, were allegedly exposed in plain text, alongside 108,077 unique UK vehicle registration plates tied to owner emails, mobiles, airports, car parks, and dated bookings. The complete platform configuration, including campaigns, journeys, lists, segments, and templates, was also purportedly exposed as live JSON.
FulcrumSec also asserted that the breach exposed 190,849 future bookings, with 142,755 linked to vehicle registrations, which could potentially indicate when homes would be empty. The attackers claimed to have withheld the most sensitive travel details before publishing the data, accusing MAG of downplaying the severity of the breach. They also alleged that the data includes thousands of government, judicial, military, police, NHS, and defense-industry employees, posing significant security risks.
The data breach notification service Have I Been Pwned has processed the available dataset, confirming that approximately 8.8 million email addresses and phone numbers were compromised, alongside names, IP addresses, browser user-agent details, geographic information, purchases, and vehicle registration plates. This combination of information could enable highly tailored phishing attempts and other forms of fraud.
Individuals who have used MAG's parking, lounge, Fast Track, or airport Wi-Fi services are advised to be vigilant against phishing attempts that may appear more convincing. They should exercise caution with messages claiming to be about bookings, refunds, parking penalties, account issues, or payment requests. It is recommended to change passwords if they were reused across services, especially for email accounts, and to enable multi-factor authentication. Users should also review account recovery methods and avoid clicking links in unexpected messages. Legitimate organizations will not request passwords, banking PINs, or one-time authentication codes via email, SMS, or phone. If a message refers to a booking, users should manually navigate to the relevant airport or provider website instead of following embedded links. The Have I Been Pwned service allows users to check if their email address is included in the published dataset.
