Key Points

• The Manchester Airports Group cyberattack led to unauthorised access to personal data belonging to around 8.7 million customers.
• The incident affected Manchester Airport, London Stansted Airport and East Midlands Airport, all operated by MAG.
• The data accessed included email addresses, telephone numbers, vehicle registration numbers and postcodes.
• The information was linked to airport Wi-Fi registrations and bookings for parking, airport lounges and Fast Track services.
• MAG said its systems did not hold customers’ bank account or payment-card details.
• Passenger safety, aviation security, flights, terminal operations and airport parking services were not disrupted.
• MAG said it contained the risk, brought in specialist advisers and notified the relevant authorities.
• Customers are being contacted and advised to watch out for phishing attempts, scam texts and suspicious calls.
• MAG has temporarily suspended its online Manage My Booking service while the investigation continues.
• BBC News reported that MAG said it knew who was responsible and had reported the matter to authorities.

Manchester (Manchester Mirror) August 27, 2026 — has confirmed that a cyber security incident involving an unauthorised third party led to customer data being obtained from systems used across its three airports. The company said the compromised information included email addresses, phone numbers, vehicle registration numbers and postcodes, but did not include banking or payment details.

What data was accessed in the MAG cyberattack?

As reported by Matthew Sellers of Insurance Business, the data was associated with car park, lounge and Fast Track bookings, as well as registrations for the airports’ free Wi-Fi networks. The publication reported that, for most affected people, the information exposed is believed to be limited to an email address collected through a Wi-Fi sign-in.

MAG said the system accessed did not contain customers’ bank details or payment-card information. The group also said neither MAG nor the particular system affected held such financial data.

According to Rosie Shead of The Independent, the information accessed primarily comprised customer email addresses from terminal Wi-Fi registrations, alongside contact details and vehicle-registration information associated with parking, lounge and Fast Track bookings.

The scale of the incident means people who used one of the three airports’ additional services, or signed into an in-airport Wi-Fi network, may receive communications from MAG. However, an individual’s use of an airport does not necessarily mean their data was involved; the reported categories relate specifically to the affected booking and Wi-Fi systems.

Which airports are affected by the customer-data breach?

The incident concerns Manchester Airport, London Stansted Airport and East Midlands Airport, which are operated by Manchester Airports Group.

MAG said that airport operations had not been disrupted by the cyberattack. The group stated that passenger safety and aviation security had not been compromised, while flight schedules, terminal activity and parking services continued to operate.

As reported by Matthew Sellers of Insurance Business, MAG became aware of the intrusion on Tuesday and said it acted immediately to contain it. The group subsequently began working with specialist advisers and relevant authorities while investigating the incident and taking steps to protect its systems and customers.

BBC News reported that the data was obtained over the weekend, while MAG became aware of the breach on Tuesday. The distinction reflects the reported timeline between the unauthorised access and the airport operator’s detection of the incident.

MAG has also temporarily suspended its online Manage My Booking service as a precaution while enquiries continue, according to Insurance Business.

What has MAG said about the response to the incident?

MAG said it contained the risk after becoming aware of the cyber security incident and is working with specialist advisers. It has informed and is working with the relevant authorities, according to reports based on the group’s statement.

The company has apologised for concern caused and said it takes the security of customer information seriously. It is contacting affected customers directly, according to Insurance Business.

MAG’s public information has focused on the security of its systems, customer notification and the lack of operational disruption. It has not, in the information reviewed, identified the unauthorised third party publicly or set out a detailed technical account of how access was gained.

BBC News reported that MAG said it was aware of the identities of the hackers and had reported the incident to the appropriate authorities.

The airport operator has also advised customers to take care with unexpected communications. Insurance Business reported that MAG warned that it would not unexpectedly ask customers to provide banking information.

How could affected customers protect themselves from scams?

The data categories involved could be used to make fraudulent messages appear more credible, particularly where an email, mobile number, vehicle registration or airport-service reference enables a criminal to imitate a travel-related communication.

As reported by Matthew Sellers of Insurance Business, Raghu Nandakumara of cyber security company Illumio told Infosecurity Magazine that the data could increase the likelihood of targeted phishing and smishing attempts. Such messages may use genuine travel-related details to encourage a recipient to follow a link, disclose credentials or make a payment.

Customers who believe they may be affected can take the following proportionate precautions:

• Read communications claiming to be from MAG carefully and avoid acting under pressure.
• Do not open attachments or follow links in unexpected emails or text messages.
• Do not share passwords, card details, banking information or security codes in response to an unsolicited message.
• Access airport booking details by entering the official airport website address into a browser rather than using a link in a message.
• Treat calls referring to parking, Fast Track, lounges or Wi-Fi registration with caution, particularly if the caller seeks financial or login details.
• Keep an eye on accounts and report suspicious messages to the relevant provider or reporting service.

The absence of payment-card and banking information reduces one immediate category of risk, but it does not eliminate the possibility of impersonation or social-engineering attempts using personal contact and travel-related data.

What does the incident mean for MAG’s regulatory responsibilities?

The Information Commissioner’s Office may consider whether the incident requires formal reporting and whether MAG’s response met data-protection obligations. Under UK GDPR, organisations must notify the regulator within 72 hours of becoming aware of a personal-data breach where it is likely to create a risk to individuals’ rights and freedoms.

As reported by Matthew Sellers of Insurance Business, MAG’s reported sequence discovering the issue on Tuesday before public confirmation and customer notification by Thursday indicates that the company was acting within the time frame relevant to a potential notification assessment.

A regulatory assessment would consider the type and sensitivity of the data involved, the number of people affected, the risk of misuse, the measures taken to contain the breach and the information provided to customers. MAG’s statement that no financial information was stored in the affected system will be relevant context, although the number of people potentially affected remains substantial.

What is the background to cyber risk in aviation and insurance?

The MAG incident follows wider concern about cyber resilience in aviation, particularly where airports rely on connected suppliers, booking platforms and service systems.

As reported by Matthew Sellers of Insurance Business, an attack on check-in and boarding systems at Heathrow, Dublin and Brussels in September 2025 was linked to supplier Collins Aerospace. That episode led to manual processes, including handwritten boarding passes and manual baggage tags, and renewed attention on supply-chain cyber risk and business-interruption insurance.

The same report cited research by Gallagher and the Centre for Economics and Business Research which put the total cost of cyberattacks to large UK businesses at £11.7 billion in 2025. The research identified disrupted trading as the largest direct cost, followed by shareholder litigation, lost intellectual property, regulatory fines, reputational damage and customer losses.

MAG has not publicly said whether it holds dedicated cyber insurance, according to Insurance Business. The eventual financial implications will depend on the continuing forensic investigation, customer-notification costs, regulatory outcomes and the effectiveness of measures to prevent misuse of the accessed data.

How could the MAG cyberattack affect passengers and airport customers?

For passengers, the immediate operational position is that MAG says its airports remain open and that flights, security and parking services are continuing normally. Travellers using Manchester, London Stansted or East Midlands Airport may nevertheless experience additional caution around booking communications while the company’s online Manage My Booking service remains suspended.

Customers whose information may have been accessed could face a higher risk of convincing phishing emails, scam text messages or fraudulent calls that refer to airport services. The main practical effect is likely to be increased scrutiny of communications relating to parking, Wi-Fi access, lounges, Fast Track services and travel bookings.

For MAG, the development is likely to lead to continued customer contact, technical investigation and engagement with authorities. The outcome will depend on what investigators establish about the breach, the effectiveness of MAG’s containment measures and whether accessed information is subsequently misused.