Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal

A hacker group named FulcrumSec claimed responsibility for breaching Manchester Airports Group's systems by exploiting exposed administrative keys embedded in the frontend JavaScript of the websites for Manchester, London Stansted, and East Midlands airports. The attackers exfiltrated roughly 550GB of data, including personal information of approximately 8.8 million people such as names, emails, phone numbers, postal regions, vehicle registrations, and booking details for airport services. MAG disclosed the breach and ransom demand but declined to pay. The stolen data was stored on a third-party database. The breach did not affect airport operations. The extortion group published the data after ransom refusal. The incident was publicly reported by SecurityWeek and analyzed by HaveIBeenPwned, which confirmed the scale of compromised email addresses and phone numbers.

The breach exposed sensitive personal data of approximately 8.8 million individuals, including contact details, vehicle registration plates, and booking information for airport services. This exposure increases the risk of identity theft, phishing, and targeted scams against affected individuals. Although MAG's airport operations were not disrupted, the compromise of administrative keys and extensive personal data represents a significant privacy and security incident. The publication of the data following ransom refusal means the information is publicly accessible, potentially leading to long-term misuse.

MAG has publicly disclosed the breach and confirmed that the ransom demand was refused. No specific patch or remediation is applicable since the breach resulted from exposed admin keys in frontend code. Organizations should review and secure any exposed credentials or keys in publicly accessible code and audit third-party hosted databases for security. Affected individuals should be notified and advised to monitor for phishing or fraud attempts. MAG and similar organizations should implement secure key management practices to prevent exposure of sensitive credentials in client-side code.