Cyberattack Exposes Data of 8.7 Million Manchester Airports Group Customers

A major cyberattack has compromised the personal information of approximately 8.7 million customers across the Manchester Airports Group (MAG) portfolio. The breach represents one of the largest security failures affecting UK transport infrastructure, exposing millions of travelers to potential fraud.

According to confirmed reports, the attack targeted the operator's systems, affecting passengers who used Manchester Airport, London Stansted, and East Midlands airports. The stolen data includes a range of sensitive personal identifiers, specifically email addresses, phone numbers, postcodes, and vehicle registration details. While the breach was initially linked solely to Manchester Airport, it is now clear the impact spanned the entire MAG network.

Infrastructure Vulnerabilities

Manchester Airports Group operates some of the UK's busiest aviation hubs, making its data management systems a high-value target for cybercriminals. The scale of this breach—affecting nearly nine million individuals—highlights a systemic vulnerability in how critical transport infrastructure handles vast quantities of passenger and parking data. As airports increasingly digitize the traveler experience, from pre-booked parking to digital check-ins, the surface area for potential attacks has expanded significantly.

Risks to Travelers

The exposure of this specific dataset creates a high risk of targeted phishing and identity theft. By combining vehicle registrations with phone numbers and postcodes, attackers can craft highly convincing fraudulent communications. Travelers may receive spoofed messages appearing to be from airport authorities or parking services, designed to trick them into revealing financial information or installing malware. For the industry, the incident underscores the urgent need for more robust encryption and data minimization strategies to protect passenger privacy.

Next Steps

Attention now turns to the full extent of the breach and whether more sensitive financial data was accessed. While the current confirmed list of stolen data focuses on contact and vehicle details, the investigation into the entry point of the attack continues. Passengers across the three affected airports are advised to remain vigilant for suspicious communications and monitor their accounts for unauthorized activity.