FulcrumSec claims 86 GB data theft from Manchester Airports Group
New evidence suggests the breach of the UK's largest airport operator is far more detailed than initially disclosed.
The extortion group FulcrumSec has claimed responsibility for a massive data breach at Manchester Airports Group (MAG), alleging the theft of approximately 86 GB of sensitive information. The incident represents a significant blow to the UK's largest airport operator, putting millions of travelers at risk.
The breach impacts customers across three major hubs: Manchester, London Stansted, and East Midlands airports. While MAG previously disclosed that roughly 8.7 million customers were affected, the company initially suggested that the exposure was limited primarily to email addresses, along with phone numbers, vehicle registrations, and postcodes. However, evidence now suggests the stolen dataset is significantly more granular.
According to a report by BleepingComputer, samples of the stolen data include detailed booking references, parking dates and times, IP addresses, device information, and customer-engagement data. To verify the authenticity of the leak, BleepingComputer compared one record against a traveler's known purchase history. This validation confirmed that the hackers possessed specific details regarding the traveler's spending, the terminal they used, and their purchase of Fast Track services.
The Extortion Threat
The attack is attributed to FulcrumSec, a financially motivated data-extortion group active since 2025. Unlike traditional ransomware gangs that encrypt systems to halt operations, FulcrumSec specializes in the theft and subsequent extortion of sensitive data. The group has a track record of targeting high-profile organizations, with previous claims including attacks on LexisNexis, Novo Nordisk, and Avnet.
Industry Implications
The depth of the stolen information significantly elevates the risk for the affected millions of travelers. Because the data includes specific travel dates, terminals, and spending habits, it provides a blueprint for highly convincing, targeted phishing and social engineering attacks. Attackers can use these concrete details to impersonate airport officials or travel providers, making fraudulent communications appear legitimate to unsuspecting victims.
Current Status
MAG first disclosed the breach on August 27, attributing the theft to an unauthorized third party. In a statement, a MAG spokesperson said the company is "confident that we have taken effective measures to protect our customers" and noted that they have contacted those affected, including passengers with upcoming bookings, to provide additional support.
While the general scope of the data theft has been validated through sample records, several technical claims made by FulcrumSec remain unconfirmed. These include the specific method of entry and the exact volume of records pertaining to future travel. Security analysts continue to monitor the situation as the full extent of the exposure becomes clear.