The extortion group FulcrumSec has published about 550GB of uncompressed customer data stolen from Manchester Airports Group (MAG). MAG runs Manchester, London Stansted and East Midlands airports, and the leak followed its refusal to pay a ransom. MAG confirmed the breach on August 27, 2026, and later confirmed it had received a ransom demand. Estimates of how many people are affected vary slightly. The Guardian, Help Net Security and the BBC report about 8.7 million, and FulcrumSec itself claims nearly 8.7 million customer profiles. Have I Been Pwned (HIBP) analysed the leaked files and counted about 8.8 million unique email addresses and phone numbers, according to SecurityWeek. MAG has not published its own figure. The data is now free to download, so affected customers face a real risk of follow-on phishing, fraud and targeted scams.
What Happened
MAG's statement, published on its incident page and quoted by SecurityWeek and Help Net Security, says an "unauthorised third party" obtained "a quantity of customer data" linked to car park, lounge and Fast Track bookings and to in-airport Wi-Fi sign-ups at all three airports. The company says it "immediately contained the risk," brought in specialist advisors and informed the relevant authorities. It also says passenger safety, aviation security and airport operations were not affected.
According to SecurityWeek, MAG said the data came from "a database hosted by a third party" and confirmed it had received a ransom demand. It gave no details about the attacker or the terms. Over the weekend after the disclosure, FulcrumSec claimed responsibility. At first it said it had taken about 86GB of compressed data. By September 3, SecurityWeek reported that the group had published about 550GB of uncompressed data. Infosecurity Magazine puts the figure at about 549GB and says the leak appears to contain almost the whole stolen dataset. The group's leak-site post read: "Half a terabyte, and every byte of it is pure PII." The BBC, which chose not to name the group, reports that the dataset is being offered free to other criminals.
Help Net Security reported that MAG switched off its online Manage My Booking portal as a precaution and sent customers to phone support. MAG's current FAQ points customers back to Manage Booking and says bookings can be changed or cancelled free of charge because of the incident. That suggests the portal has since come back online. MAG says it has contacted all affected customers, including those with upcoming bookings.
What Was Taken
Accounts of the stolen data differ depending on who is describing it:
- MAG's statement: email addresses, phone numbers, vehicle registrations and postcodes. MAG says neither it nor the affected system holds bank or payment details.
- HIBP's analysis (reported by the BBC and SecurityWeek): email addresses, phone numbers, names, addresses, vehicle registration plates, purchase history, and browser or device data.
- FulcrumSec's claims (reported by Infosecurity Magazine and SecurityWeek, not independently verified):
- about 8.7 million customer profiles with name, email, mobile number, home town, postcode and residential IP address
- about 1.2 billion marketing events (sends, opens, clicks)
- 2,482,763 purchases covering parking, lounge and Fast Track bookings
- 461,433 SMS messages containing booking dates, car park details and vehicle registrations in plain text
- 108,077 unique UK vehicle registration plates
- platform configuration data
- records of nearly 191,000 future bookings
According to the Guardian, most of the affected records relate to Wi-Fi sign-ups in the terminals. The HIBP findings go beyond the four data types MAG listed. Names, purchase history and device data are all confirmed in the published dataset. Infosecurity Magazine notes that FulcrumSec's claims describe a much broader set of data than MAG first disclosed.
Why It Matters
The main concern here is that the data reveals where people travel and when, not just their contact details. Security researcher Kevin Beaumont told the BBC that "the data includes both historical locations and planned future travel," and that people who need to keep their movements private, especially high-profile or wealthy people, may need to take precautions. Booking dates, car park details and number plates together tell someone when a person's car will be parked at an airport and when their home is likely to be empty.
For fraud, the data makes scams much more convincing. A message that quotes a real booking reference, number plate and travel date is far more believable than generic phishing. MAG has warned that it will "never contact you unexpectedly to request payment card details, banking information, or passwords." The residential IP addresses FulcrumSec claims to hold would also give attackers rough location data and possible targets for scanning.
The case also shows how much customer data now sits in third-party marketing and engagement platforms. Those platforms hold detailed behavioural records that can be outside the organisation's usual security monitoring.
The Attack Technique
FulcrumSec told BleepingComputer (as cited by Journalism Central) and wrote in its leak note (as reported by Infosecurity Magazine) that it got in using admin API keys for Iterable, a customer engagement platform. The group says the keys were exposed in the frontend JavaScript of all three airport websites. In its words: "any of the millions of visitors to the site could have right-clicked 'inspect' and seen the keys just sitting there, plain as day." It added that, unlike the credentials it says it used against Arup Group and Novo Nordisk, these keys were on the root domains and not on obscure subdomains.
MAG has not confirmed this account or named Iterable. However, the claim fits MAG's statement that the data sat in a third-party-hosted database. It also fits the marketing-event and SMS data the group says it took. SecurityWeek describes FulcrumSec as a financially motivated group that emerged in 2025 and has claimed several high-profile breaches. The access method needed no exploit, only a secret left somewhere anyone could read it.
What Organizations Should Do
- Scan client-side code for secrets. Add secret scanning to CI/CD pipelines and regularly crawl production JavaScript bundles on every domain, including root domains. Admin or server-side API keys should never reach the browser.
- Use scoped, client-safe keys for SaaS integrations. Check every marketing, analytics and engagement platform integration. Frontend code should only use public, write-limited or JWT-secured keys, and admin keys should be rotated on a schedule.
- Watch SaaS platforms for bulk data access. Collect audit logs from customer engagement platforms. Alert on large exports, API calls from unfamiliar IP addresses, and use of admin keys outside expected automation.
- Keep less data in marketing tools. Don't store residential IPs, precise travel dates or vehicle details in engagement platforms unless there is a clear need. Set retention limits so old events and SMS logs are deleted.
- Plan for travel-data exposure. For businesses that handle bookings, plan how to contact customers with upcoming travel, how to warn them about phishing that uses real booking details, and how to give extra help to at-risk individuals.
- Check your own users against the leak. Use HIBP domain search to find staff or customer accounts in the MAG dataset. Expect targeted phishing that uses airport, parking or lounge themes.
Sources: Hackers Leak Data on 8.8 Million People After Manchester Airports G... | Criminals publish data of 8.7m people after airports hack - BBC | FulcrumSec Claims Responsibility for Manchester Airport Group ... | Extortion Group Claims Manchester Airports Group Data Breach | Manchester Airports Group breached, millions of customers’ data sto... | Manchester Airports Group Data on 8.8 Million People Leaked ... | Three UK airports hit by cyber-attack with data of 8.7m customers ... | Manchester Airport Data Security Incident - Update & FAQs