Manchester Airports Group breach exposes 8.8 million customer records

Manchester Airports Group (MAG) has suffered a massive data breach affecting approximately 8.7 to 8.8 million customers across Manchester, London Stansted, and East Midlands airports. The incident underscores a critical security failure in how the airport operator managed its third-party marketing integrations.

The breach was executed by a threat actor known as FulcrumSec, who claims to have gained access by discovering overprivileged API credentials for the Iterable marketing platform. These credentials were embedded directly in the client-side JavaScript of MAG's websites, allowing the attackers to bypass standard security boundaries and query the API directly. According to FulcrumSec, the process was trivial: "Open developer tools, read the page source, take the key, query the marketing platform’s API."

The Scope of Exposure

The exfiltrated data consists of comprehensive customer profiles stored within the Iterable platform. Confirmed leaked information includes email addresses, phone numbers, and postcodes. Notably, the breach also exposed vehicle registration numbers associated with bookings for airport car parks, lounges, and Fast Track services. While the threat actor attempted to extort the company following the theft, reports indicate that MAG refused to pay the ransom.

A Systemic Security Failure

This incident highlights a common but dangerous architectural error where server-side API keys—which often possess broad read and write permissions—are mistakenly placed in front-end code to enable specific website features. In this instance, the Iterable platform was used to store tier-one customer data, yet the exposed key provided a direct gateway to the entire database. This reflects a systemic risk where organizations treat marketing automation tools as low-security systems, despite those tools holding sensitive personal identifiable information (PII).

Industry Implications

The theft of specific booking details, such as vehicle registrations and contact information, creates a high risk for targeted social engineering. Attackers can use these concrete details to impersonate airport authorities in highly convincing, time-sensitive phishing campaigns designed to steal payment details from travelers. For the broader aviation and travel industry, the breach serves as a warning to audit the permissions of all API keys embedded in public-facing code.

What's Next

Industry observers are now watching for official regulatory responses and potential fines under data protection laws. While the core mechanism of the breach is understood, the full extent of the data's distribution remains a concern as the stolen records enter the underground ecosystem. It remains to be confirmed exactly how long the API keys were exposed before they were discovered and revoked.