Manchester Airports Group data breach: what happened and what to do

What happened

Manchester Airports Group (MAG) runs Manchester, London Stansted and East Midlands airports. On Thursday August 27, 2026 it disclosed a cyber incident affecting customer data. In its statement, MAG said that at no point had passenger safety or aviation security been compromised, and reports quote it saying airport operations were not disrupted.

BleepingComputer reported that hackers stole traveler data. The FulcrumSec group later claimed the attack and published data, according to a second report. Press coverage says a ransom was demanded and not paid. MAG has reported the incident to the Information Commissioner's Office, which is assessing it, and has contacted affected customers.

How many people

MAG's own figure is about 8.7 million customers. Have I Been Pwned counted 8,849,657 unique email addresses, about 8.8 million. The two numbers measure different things, customers versus email addresses.

What was exposed

Have I Been Pwned lists browser user agent details, email addresses, geographic locations, IP addresses, names, phone numbers, purchases and vehicle registration plates. The records relate to airport services, including car park bookings and parking history, Fast Track purchases, lounge bookings and in-airport Wi-Fi sign-ups.

MAG says neither the system that was accessed nor the company holds customers' bank or payment details.

What that lets criminals do

A vehicle registration linked to a name, phone number and parking history says where you were and when, and what car you drive. Scammers can use that to write a convincing message about a parking charge, a lounge booking or a Fast Track purchase.

Phone numbers and emails make text and email phishing easy. Expect messages that claim to be from MAG, an airline or a parking firm.

The company's response

MAG has contacted affected customers and warned of phishing. It switched off its online Manage My Booking portal as a precaution, so changes within 72 hours of a booking go through customer services. It also says it will never contact you unexpectedly to ask for payment card details, banking information or passwords.

Why travel data is sensitive

Travel records show when a home may be empty and which routes you take. Vehicle registrations tie a name to a car. None of that is a password, but it is the kind of detail that lets a scammer sound as if they know you, so it deserves the same caution as other personal data.

If you've used these airports

Search your email on Have I Been Pwned. Treat any message about a parking charge, refund or booking problem with care, and use MAG's own websites to check a booking, not a link.