MANCHESTER Airports Group (MAG), which operates Manchester, London Stansted and East Midlands airports, disclosed a data breach affecting data held in a third‑party database. The incident, announced on 27 August 2026, involved customer information relating to MAG’s parking, lounge and Fast Track bookings, as well as airport Wi‑Fi sign‑ups. MAG said no payment‑card data was accessed and that operations, passenger safety and aviation security were not affected.
The attackers, an extortion group calling themselves FulcrumSec, claimed responsibility and leaked a substantial dataset after MAG reportedly refused a ransom. FulcrumSec alleged that access was gained via administrator keys embedded in the frontend JavaScript of MAG’s three airport websites, each site reportedly hardcoding its own key to access millions of passenger records; MAG has not independently verified these claims, and SecurityWeek has not confirmed them.
Have I Been Pwned processed the published data and lists about 8.8 million email addresses and phone numbers compromised, along with names, IP addresses, browser user‑agent data, geographic information, purchases and vehicle registration plates. FulcrumSec published roughly 550 GB of data, including 8,672,291 customer profiles and 2,482,763 purchases, plus 461,433 SMS messages and 108,077 unique UK vehicle registrations tied to owners’ details.
The leak is described as providing a practical fraud kit: attackers could link a person to a booking, a car, a location and a contact number. MAG advised affected users to monitor for targeted phishing and to secure accounts, including changing reused passwords and enabling multi‑factor authentication, while avoiding links in unexpected messages.