The Manchester Airports Group Data Breach: What You Need to Know

Introduction

On 27 August 2026, Manchester Airports Group (MAG), which owns and operates Manchester, London Stansted and East Midlands airports, confirmed that an unauthorised third party had accessed customer data. Roughly 8.7 to 8.8 million people were affected, making it one of the largest data breaches involving a UK airport operator to date.

If you have ever booked airport parking, a Fast Track slot, a lounge visit or signed up for in-terminal WiFi, this affects you directly. And if you run a business, it is also worth paying attention for a different reason: the cause of the breach is a mistake that is surprisingly easy for organisations to make.

What happened

MAG disclosed that data related to car park bookings, lounge bookings, Fast Track purchases and airport WiFi sign-ups had been accessed by an unauthorised third party. The information exposed included email addresses, phone numbers, vehicle registrations and postcodes.

Importantly, MAG confirmed that no payment card or banking details were held on the affected system, and the incident had no impact on airport operations, passenger safety or aviation security.

A few days after the disclosure, an extortion group calling itself FulcrumSec claimed responsibility, stating it had stolen around 80 to 86 GB of data. Security researchers reported that samples of the leaked material went beyond MAG's initial disclosure, including consolidated customer profiles and booking history data.

How did it happen

According to security researcher Scott Helme, the breach did not require any sophisticated hacking. FulcrumSec's own account, which independent verification appears to support, is that an API key for each airport had been sitting in plain sight inside the airports' public-facing website JavaScript, unrotated for over four years.

In other words, the credentials needed to access customer data were effectively visible to anyone who inspected the website's source code. Analysis suggests one of the keys had been exposed since as early as July 2022, meaning the data had potentially been vulnerable for years before it was exploited.

This detail matters well beyond MAG. Any website JavaScript is fully visible to anyone who looks. It runs in the visitor's browser, not on a private server. If an API key, token or password is embedded in that code, it is effectively public to anyone who chooses to inspect it.

For a business owner, the uncomfortable takeaway is that a breach like this does not require a sophisticated attacker or a dramatic hack. It requires one overlooked line of code and nobody checking for it. That is exactly the kind of issue a routine security review or Cyber Essentials assessment is designed to catch before it becomes a headline.

What MAG has said

MAG's public statement confirmed the scope of the breach and struck a reassuring tone regarding operations. It said passenger safety and aviation security had not been compromised and there had been no operational disruption. Airport operations remained unaffected and customer parking services continued to operate normally.

MAG also said it acted quickly to contain the issue, restricted access to affected systems, brought in specialist cyber security advisors and notified the relevant authorities. The company stated that its Data Protection team is overseeing the response and apologised to customers for the concern and inconvenience caused.

On bookings specifically, MAG confirmed that any upcoming bookings remain valid and unaffected, and customers who wish to cancel or amend a booking because of the incident can do so free of charge, with a full refund.

What you need to do if affected

If you're a customer

• • Watch for phishing and impersonation attempts. The exposed data includes exactly the kind of details that make a scam email or text appear legitimate.
• • Do not click links or open attachments in unsolicited messages. If something claims to be from MAG, go directly to the official website instead.
• • Remember MAG will never ask for payment card, banking or password details out of the blue.
• • Check if your details were in the published dataset using a reputable breach-monitoring service.
• • Review MAG's official guidance and the NCSC's breach guidance.

If you're a business owner

• • Audit your public-facing code for hardcoded secrets. API keys, access tokens and credentials should never sit directly in JavaScript.
• • Rotate credentials on a schedule, not just when something goes wrong.
• • Know exactly what customer data you store and why.
• • Have an incident response plan ready before you need it.
• • Consider whether you are aligned with recognised security standards such as Cyber Essentials.

If you would like a second pair of eyes on any of this, a no-obligation review is often the easiest way to identify whether you have a similar blind spot before it becomes your own headline.