Manchester Airports Group attack: Everything we know so far as 8.7 million customers impacted in breach

Data belonging to millions of customers has been accessed in a cyber attack on Manchester Airports Group (MAG), the company has revealed.

MAG, which runs Manchester, London Stansted, and East Midlands airports, confirmed a cybersecurity incident on 27 August.

Data exposed in the breach relates to car park, lounge and Fast Track bookings, and on-site Wi-Fi at all three airports, the company revealed in a statement. This includes:

• Customer email addresses
• Phone numbers
• Vehicle registrations
• Postcodes

MAG noted that banking and payment details were not exposed in the breach, which at this point is believed to have impacted around 8.7 million customers.

The company added that the breach hasn’t resulted in any operational disruption, with airport operations remaining unaffected. Customer parking services are still operating as expected.

"All upcoming bookings remain valid and are unaffected by this incident," it said. "Passengers should continue to travel to the airport as normal."

MAG said it has restricted access to the affected systems, called in specialist cyber security experts, and notified the relevant authorities.

Who is responsible for the breach?

At present, there’s no indication on who is responsible for the breach, or how it occurred. However, like many recent attacks on organizations, the incident appears to have been a supply chain-related attack.

Nathan Davies-Webb, principal consultant at Acumen Cyber, said modern airports “sit at the center of a complex web of booking, parking, loyalty, payment, and internet connectivity services”.

“Many of the services in that ecosystem run on platforms operated by subsidiaries or third-party suppliers rather than the airport itself," he commented.

"That's a sensible commercial model but it creates an uncomfortable reality for security. A breach like this one in a shared upstream system can expose customer data from multiple services at multiple airports simultaneously."

Last year, a report from Thales highlighted a 600% increase in ransomware attacks in the aviation sector over the previous year, with 27 major attacks by 22 ransomware groups between January 2024 and April 2025.

A string of attacks on Hawaiian Airlines, Canada's WestJet and Qantas over the last year have all been attributed to the Scattered Spider group.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, said the nature of the data exposed poses a significant threat to customers. Cyber criminals frequently rely on exposed information such as email addresses to conduct follow-up phishing campaigns.

“Email addresses, phone numbers, and vehicle registrations combined is a precise targeting profile for anyone planning a follow-on fraud or phishing campaign. Scammers now know you travelled, roughly when, and have two direct contact routes to reach you with a convincing story," he said.

"When that data ends up in an unauthorized third party’s hands alongside parking and lounge booking details, it fills in a surprisingly detailed picture of someone’s travel habits."

MAG urges customers to remain vigilant

MAG warned customers to remain vigilant for suspicious emails, text messages, or phone calls, and avoid clicking on links or opening attachments from unexpected communications.

The company stressed that it will never request payment card details, banking information, or passwords from customers.

Davies-Webb commended MAG for its swift response to the incident, although data protection regulations require enterprises to disclose breaches within a strict time frame.

"Public disclosure roughly forty-eight hours after they became aware is fast by UK standards and can point in one of two directions," said Davies-Webb.

"Either MAG undertook containment decisively enough that they felt safe releasing details of the breach on their own terms, or the volume and nature of the personal data compromised meant the seventy-two hour notification clock under UK GDPR was already running and disclosure was going to have to happen.”

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.