Hackers have leaked the personal details of 8.7 million people following an attack on three British airports.
The incident was first disclosed in late August, impacting travellers at three locations managed by Manchester Airports Group (MAG): Stansted, East Midlands, and Manchester airports.
The criminals behind the attack, believed to be FulcrumSec, published the data online, claiming to have half a terabyte of personally identifiable information.
However, the hackers reportedly said they wouldn't be selling "dangerous" data about future travel plans over concerns it would lead to stalking or burglary.
"This is an expected update, but it’s one none of the victims wanted to hear," said Timon Johnson, principal cyber essentials assessor at Closed Door Security.
"It was always unlikely MAG would pay the ransom demand as it is akin to doing business with criminals, and it’s also highly unlikely the data would ever have been returned in full without further exploitation."
Free release as punishment
Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, agreed that MAG made the right call by refusing to pay the ransom.
However, that decision puts nearly nine million people at risk for mistakes that weren't made by them.
"The 'free release' model is deliberately designed to maximize harm and reputational damage as a warning to the next target," he said.
"Publishing almost nine million records for free isn't just punishment for MAG — it's a marketing campaign aimed at every other organization watching. Pay up, or your customers' data gets handed to every fraudster and scammer on the internet at no cost."
At this point, the airlines group says it has contacted everyone whose data was compromised.
"MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, including reaching out to all those with upcoming bookings to advise them of additional support," the company said in a statement sent to the BBC.
What happened?
The attack is believed to have started over the weekend of 22 August, with the intrusion spotted the following Tuesday by MAG's security team, which promptly shut down further access. The attack was publicly disclosed on Thursday, 27 August.
FulcrumSec later claimed responsibility for the attack, saying it would publish the data owing to MAG not negotiating a ransom. Yesterday, they followed through with that threat.
MAG said in a statement that the customer data relates to the car park, lounge, and Fast Track bookings at the airports, as well as Wi-Fi signups, stressing there had been no operational disruption and that aviation security had not been compromised.
The data taken includes email addresses, phone numbers, vehicle registrations, and postcodes, but does not include bank or payment card details.
What now?
As the data has been published on the open web, the focus now turns to scams against the 8.7 million victims.
"Now that the data is available for free on the dark web, other criminals will be working to exploit it," says Johnson. "Phishing presents the greatest risk, and all individuals must be vigilant for scams. These could come in via email, phone calls or texts, so all these communication methods must be monitored closely."
As ever, this means constant vigilance online: be wary of clicking links or opening attachments and don't share any financial or other personal data unless the receiver has been verified, added Johnson.
The inclusion of travel data exacerbates the risk, according to security expert Kevin Beaumont.
"The data includes both historical locations and planned future travel, so individuals sensitive to their movements being known may need to take precautions," he told the BBC.
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
Everything we know about the Dropbox breach so far
Should businesses consider using Chinese AI models?
