MAG Cyber Attack Affects 8.7m Airport Customers 2026

Key Points

• Manchester Airports Group (MAG) confirmed a cyber security breach on 27 August 2026 that has compromised approximately 8.7 million customers of Manchester, London Stansted and East Midlands airports.
• The breach has led to the exposure of email addresses, phone numbers, vehicle registration numbers, and postcodes associated with bookings for car parks, lounges, Fast Tracks, and in-airport WiFi.
• According to MAG, there was no breach of any payment card information, bank details, and operations systems, and there was no impact on passenger safety or aviation security.
• Information Commissioner’s Office (ICO) confirmed that it had been notified about the breach and was analyzing the information.
• In an extortion demand, group FulcrumSec took responsibility for the theft of 86GB worth of data, which includes about 200,000 data sets of people traveling from Manchester airports in the coming months of 2026.
• MAG has suspended its online “Manage My Booking” service temporarily for the same reason.

Manchester (Manchester Mirror) September 01, 2026 – A cyber security incident targeting the UK’s largest airport operator has exposed personal data belonging to approximately 8.7 million customers, prompting warnings about potential phishing risks while authorities investigate the breach.

What happened in the MAG cyber attack?

Manchester Airports Group (MAG), which operates Manchester Airport, London Stansted and East Midlands Airport, disclosed on Thursday, 27 August 2026, that an unauthorised third party had accessed customer data across all three airports. The company said it became aware of the incident on Tuesday and immediately contained the risk, working with specialist advisers and notifying the relevant authorities.

As reported by Georgie Dockerand and Mat Trewern of BBC News, MAG told the broadcaster that criminal hackers demanded a ransom fee for the return of the data, which the group refused to pay. The sum of the ransom was not disclosed.

In a statement, MAG said: “We would like to reassure customers that Manchester Airport Group takes the security of customer information extremely seriously and we apologise for any inconvenience or concern caused”. The company added: “We immediately contained the risk and have been working with specialist advisors and taking appropriate steps to protect our customers and systems”.

Which airports and services were affected?

The cyber attack affected all three airports operated by MAG: Manchester Airport in the North West of England, London Stansted Airport in Essex, and East Midlands Airport in Derbyshire. According to MAG’s disclosure, the incident involved data related to “car park, lounge and fast-track bookings and in-airport wifi sign-ups”.

As reported by multiple outlets including The Guardian, the compromised information primarily consisted of customer email addresses gathered from terminal Wi-Fi registrations, with more detailed data including phone numbers, vehicle registration numbers and postcodes linked to customers who had booked car parking, lounge access or Fast Track security services.

MAG confirmed that neither the company nor the affected system held customers’ bank or payment information. The operator also stated that the incident did not involve its operational airport systems, meaning flight schedules, terminal operations and parking services across all three locations remained fully operational.

What personal data was exposed in the breach?

The personal data accessed in the breach includes email addresses, phone numbers, vehicle registration numbers and postcodes. For the majority of the 8.7 million affected individuals, the exposure is believed to be limited to email addresses collected through free Wi-Fi sign-ups at the airports’ terminals.

However, customers who had made bookings for car parking, lounge access or Fast Track services had additional information exposed, including vehicle registration numbers and postcodes associated with those bookings. In an email sent to affected customers, MAG stated:

“Our investigation has identified that some of your personal information relating to airport car parking, lounge, Fast Track bookings and on-airport WIFI sign-ups has been accessed by an unauthorised third party”.

Security researchers have highlighted that UK postcodes present a heightened privacy risk compared to other jurisdictions. Unlike American ZIP codes covering broad delivery areas, a full UK postcode typically identifies a small cluster of neighbouring addresses, sometimes a single property, according to the Office for National Statistics. Combined with vehicle registrations, parking dates and specific booking references, this data could enable highly convincing phishing messages targeting people with upcoming trips.

Who claimed responsibility for the MAG data breach?

On 30 August 2026, three days after MAG’s initial disclosure, the extortion group FulcrumSec claimed responsibility for the attack, alleging it stole approximately 86GB of data from the airport operator. As reported by Pierluigi Paganini of SecurityAffairs, FulcrumSec shared samples with BleepingComputer that included a 21.5GB export of Manchester customer data containing personal identifiers, historical booking details and marketing information.

FulcrumSec claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript. According to the group, the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026, with dates, times and booking information linked to personally identifiable information.

BleepingComputer reportedly checked one record against a real traveller’s purchase history and found matching Fast Track bookings, arrival times, terminal information and payment amounts. When asked about FulcrumSec’s specific claims, MAG declined to directly address the 86GB figure or the exposed-credentials allegation, instead pointing to its existing statement that affected customers with upcoming bookings had already been contacted.

A MAG spokesperson told SecurityAffairs: “MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected”. FulcrumSec has indicated it intends to publish the stolen data and a technical account of the intrusion, though it may redact upcoming travel records because of the risk of real-world harm.

How have authorities and customers responded?

The Information Commissioner’s Office (ICO), the UK’s data protection regulator, confirmed it received a breach report from MAG and is assessing the information provided. A spokesperson for the ICO said: “We can confirm we have received a breach report from Manchester Airports Group, and we are assessing the information provided”. The organisation said anyone concerned by the breach was able to access support on the ICO website.

Customers who received notification emails from MAG expressed concern about the breach. Michael Goddard, 71, from Cheshire, told BBC Radio Manchester: “I was shocked. To find your personal info has been stolen – it is alarming”. He added: “My information has gone and I don’t know what they’re going to do with it. They have my address in the form of the postcode, they’ve got my name, so it doesn’t take too much to find out who I am”.

Goddard said he was not entirely reassured by MAG’s statements:

“I’m not 100 per cent reassured by what Manchester Airports Group has said”. He and his wife, Julie, 68, both received emails after travelling from East Midlands Airport earlier in the year and using the online booking service for parking at Manchester Airport.

“The concern is there for both of us. We want the reassurance that if anything happens, they will adequately compensate us,”

he said.

MAG has urged customers to remain vigilant about suspicious emails, text messages or phone calls and to avoid opening unknown attachments. As a precaution, the group temporarily suspended its online Manage My Booking service while the investigation continues.

Background of the MAG cyber security incident

Manchester Airports Group is the UK’s largest airport operator, handling millions of passengers annually across its three airports. The group has increasingly relied on third-party platforms for booking, parking and loyalty services rather than systems it directly controls, according to security researchers commenting on the incident.

Iterable, the marketing platform whose API credentials FulcrumSec claims to have exploited, represents exactly that kind of outsourced dependency. The alleged exposure of API credentials in client-side JavaScript code that runs in users’ browsers means anyone inspecting the website with developer tools could potentially see those credentials, according to FulcrumSec’s claims.

This incident marks the second significant cyber security hit to UK and European aviation infrastructure within twelve months. A September 2025 ransomware attack on Collins Aerospace’s check-in software had already grounded systems at Heathrow, Brussels and Berlin airports. The pattern highlights growing vulnerabilities in aviation’s digital supply chain as operators increasingly depend on external technology providers for critical customer-facing services.

MAG said it only became aware of the hack on Tuesday, 25 August 2026, and quickly prevented the hackers from gaining any more access before notifying affected customers. The identity of the hackers was known to MAG, the company said, and the relevant authorities had been informed.

Prediction: How the MAG breach could affect travellers and the aviation sector

The MAG cyber attack is likely to have several consequences for the 8.7 million affected customers and the broader aviation industry. Security experts warn that the combination of email addresses, phone numbers, vehicle registrations and postcodes creates significant phishing risks, particularly for the nearly 200,000 individuals whose upcoming travel records may have been exposed according to FulcrumSec’s claims.

Travellers who recently booked parking, lounge access or Fast Track services should assume more travel data may be exposed and treat messages citing real booking details with caution, according to SecurityAffairs. The specificity of UK postcodes, which can identify very small groups of addresses or sometimes a single property, makes the exposed data particularly valuable for crafting convincing phishing messages that reference real upcoming trips.

For the aviation sector, the incident underscores the vulnerabilities inherent in relying on third-party technology providers for customer-facing services. As airport operations increasingly run through outsourced platforms for booking, parking and loyalty services, the attack surface for cyber criminals expands beyond the airport operator’s direct control.

The ICO’s assessment of the breach could result in regulatory action against MAG depending on its findings regarding the company’s data protection measures. Previous high-profile data breaches in the UK have led to substantial fines under the General Data Protection Regulation (GDPR), particularly where organisations are found to have failed in their duty to protect customer information adequately.

Affected customers may also pursue compensation claims if they suffer financial losses or distress as a result of the breach. Michael Goddard’s comments to BBC Radio Manchester reflect a sentiment shared by many affected individuals: a desire for reassurance that adequate compensation will be available if the exposed data is misused.

The aviation industry as a whole may face increased scrutiny from regulators and customers regarding cyber security practices following this incident and the Collins Aerospace attack in September 2025. Airport operators and their technology suppliers are likely to review their security protocols, particularly around API credential management and client-side code exposure, to prevent similar incidents in the future.