FulcrumSec claims Manchester Airports hack, theft of 86 GB of data

FulcrumSec, a financially motivated data-extortion group active since 2025, claims responsibility for a data breach at Manchester Airports Group, stealing approximately 86 GB of compressed data containing detailed customer profiles, booking histories, and travel information. The group alleges it accessed the data using airport-specific Iterable API credentials exposed in client-side JavaScript. The stolen dataset reportedly includes nearly 200,000 records of upcoming travel bookings for 2026, combining personal identifiers with travel and booking details. MAG confirmed unauthorized access affecting customer data related to car park, lounge, Fast Track bookings, and Wi-Fi registrations across three airports but declined to comment on the full scope of the claims. The breach exposed sensitive personal information but did not include payment card or bank account data in reviewed samples. MAG has contacted affected customers and stated that passenger safety and airport operations were not impacted.

The breach exposed extensive personally identifiable information, including names, contact details, vehicle registrations, booking references, travel dates, and marketing classifications for millions of customers, including nearly 200,000 upcoming travel records. This data could facilitate targeted phishing, social engineering, and impersonation attacks against affected individuals. Although no payment card or banking data was observed in samples, the detailed travel and booking information increases the risk of convincing scams. MAG reports no operational disruption or compromise to passenger safety or aviation security. The incident affects customer privacy and could lead to financial or reputational harm if exploited.

MAG has contacted all affected customers, including those with upcoming bookings, advising vigilance against suspicious communications. The airport operator emphasizes it will never request payment card details, banking information, or passwords unexpectedly. No public information indicates a patch or fix is applicable since this is a data breach resulting from credential exposure and unauthorized access. Organizations should monitor for suspicious activity related to exposed data and educate customers about potential phishing attempts. Patch status is not applicable; check MAG advisories for updates.