MAG's car park and airport Wi-Fi systems gave up 8.7 million identity records
The systems that sold parking bays, lounge passes and Wi-Fi logins were never in the same control scope as anything that moves aircraft, and they held phone numbers, plates and postcodes for 8.7 million people.
The Watch · Security desk
What happened
- Manchester Airports Group says an unauthorised third party accessed customer data tied to car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups at Manchester, London Stansted and East Midlands.
- The fields taken are email addresses, phone numbers, vehicle registration numbers and postcodes.
- A MAG spokesperson put the affected population at roughly 8.7 million people and said that in the vast majority of cases the only data accessed was an email address.
- MAG says it learned of the incident on Tuesday 25 August, after the attackers had breached the system over the preceding weekend.
Why it matters
- Who's exposed exposure Everyone who has tapped through an airport captive portal to get online is now reachable in a list that ties a mobile number to a plate and a postcode, without ever having thought of themselves as a customer of record.
- What it limits constraint MAG's accurate assurance about aviation security also marks where its hardest controls stop, and the population-scale identity data was on the far side of that line.
- Who has to decide decision Switching off Manage My Booking is the cheap response; the expensive decision is whether captive portals and add-on booking stacks now go on the personal-data inventory and into the test scope, which changes who owns them internally.
- What it costs cost Remediation and any regulatory consequence land on owners who are mostly public bodies, the ten Greater Manchester local authorities holding the majority stake, for systems that sell parking bays.
Next story · Security · 9h ago
Burger King Japan app breach reached 11.18 million customer records over six daysConfirmed2 publishers
The value of this set is the pretext it funds. A phone number sitting next to a vehicle registration and a postcode lets a caller prove he knows you before he asks you for anything [2]. MAG says the accessed system held no bank or payment card details [15], which is precisely why the follow-on traffic is the exposure: Security Affairs made the point plainly, that an attacker who impersonates the airport well enough does not need card data because the customer will read it out [6]. MAG's own notice anticipates that, telling customers it will never contact them unexpectedly to request payment card details, banking information or passwords [4]. Wi-Fi registration is the line worth reading twice, since signing into an airport network generally asks for a name, an email address and a phone number [14].
Then the arithmetic. The Record puts last year's throughput at the three airports above 65 million passengers [26]. Security Affairs gives about 54 million for the three, plus a record 66 million across MAG's wider network [27], and BleepingComputer says the three together handle over 66 million a year [28]. Against 8.7 million affected customers, that is one exposed record for roughly every seven and a half passenger journeys, or 13 to 16 percent of annual throughput depending on which passenger figure you accept [30]. The Record also notes that not all of those passengers would have touched the affected services [29], which is the finding here: optional add-ons, bought by a minority of travellers, had accumulated identity records at a scale comparable to a year of flying.
MAG says passenger safety and aviation security were never compromised [17], and nothing in the reporting contradicts that. It also describes a boundary. The tier that gave up the data is ancillary revenue plumbing, frequently vendor-supplied, and it does not sit in the control scope that protects departures. MAG has not disclosed how the intruder got in [11], so the entry route remains unknown. It contained by restricting access to affected systems, brought in outside specialists and notified authorities [13], and went public on the Thursday, two days after it was alerted [24]. This is a company of 40,000 staff and 1.5 billion pounds in annual revenue [18].
File it apart from the UK incidents it will be grouped with. Security Affairs reports that Iran-linked hackers took a British power plant offline for four days earlier in August, the first confirmed Iranian shutdown of a UK generator [20]. Last year's intrusions stopped production at Jaguar Land Rover and hit Marks and Spencer, Harrods and the Co-op [21], and Heathrow saw delays and cancellations after check-in and boarding systems were disrupted [22]. Those were availability attacks against operations; MAG kept flying and lost a database [16], and no ransomware or extortion group has claimed it [10].
The number everyone is quoting did not come from the corporate statement, which carried no figure at all [8]. BleepingComputer reported local media citing up to 8.9 million from private MAG statements and said it could not confirm the figure [9]. The gap between the two counts is about 200,000 people [23]. The absent detail is the date range, which the spokesperson did not provide [25]: it is the difference between two seasons of Wi-Fi sign-ups and a decade of them, and it determines how many of the 8.7 million last parked at Stansted years ago and have no idea they are still on file.
What to watch
- A date range for the affected records. Without one, the retention period behind the Wi-Fi sign-up set is unknown, and so is the true notification population.
- A claimant or a listing. No extortion group has named MAG, which leaves open that the set surfaces for sale rather than for ransom.
- Whether MAG names the entry point, and whether the booking and captive-portal platforms turn out to be third-party supplied.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap−35
- Incentives60
- Confidence68
Perspective Coverage
6 publishers- Builder
- Builder 30%
- Operator
- Operator 54%
- Investor
- Investor 16%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Manchester Airports Group said an unauthorized third party recently accessed customer data associated with car park, lounge and Fast Track bookings, as well as in-airport Wi-Fi sign-ups, at Manchester, London Stansted and East Midlands airports.
- [2]
The compromised information includes email addresses, phone numbers, vehicle registrations and postcodes.
- [3]
MAG says it learned about the incident on Tuesday, August 25, after attackers breached the system over the weekend.
- [4]
MAG warned customers it will never contact them unexpectedly to request payment card details, banking information or passwords.
- [5]
MAG said Thursday it was hit by a cyberattack affecting data belonging to about 8.7 million customers.
- [6]
Security Affairs assessed that the combination of an email address, a phone number and the knowledge that someone recently made a parking or lounge booking gives a convincing starting point for targeted phishing, and that attackers do not need payment data if they can impersonate the airport convincingly enough to obtain it themselves.
- [7]
MAG disclosed that an unauthorised third party accessed customer data belonging to approximately 8.7 million people across three of England's busiest airports.
- [8]
MAG says it has contacted impacted customers directly but did not disclose the number of affected individuals.
- [9]
Local media reported that data of up to 8.9 million travellers may have been exposed, citing private MAG statements; BleepingComputer said it has not been able to confirm the figure.
- [10]
At the time of writing, no ransomware or data extortion groups have claimed the attack publicly.
- [11]
MAG did not disclose how the attackers gained access to the relevant system, nor what they did while inside beyond accessing customer data.
- [12]
As a precaution MAG temporarily suspended its online Manage My Booking service; all upcoming reservations remain valid and customers needing to change a booking within the next 72 hours are directed to a customer service phone line.
- [13]
MAG said it sought to contain the breach by restricting access to affected systems, bringing in outside cybersecurity specialists and notifying relevant authorities.
- [14]
Security Affairs noted that signing into airport Wi-Fi typically requires a name, email address and phone number at minimum.
- [15]
MAG said neither it nor the affected system stores customers' bank or payment card details and that no financial data was exposed.
- [16]
MAG said flights, airport operations and parking services continue to operate normally and the incident has not resulted in operational disruption.
- [17]
MAG stated: "At no point has passenger safety or aviation security been compromised."
- [18]
MAG employs 40,000 people and generates annual revenue of 1.5 billion pounds.
- [19]
MAG is majority-owned by ten Greater Manchester local authorities, with Australian fund IFM Investors holding a minority stake.
- [20]
Security Affairs reported that earlier in August, Iran-linked hackers took a British power plant offline for four days, the first confirmed case of Iranian actors shutting down a UK generator.
- [21]
Security Affairs reported that last year attacks disrupted production at Jaguar Land Rover and targeted Marks & Spencer, Harrods and the Co-op.
- [22]
Security Affairs reported that Heathrow faced flight delays and cancellations after attackers disrupted check-in and boarding systems used by several European airports.
- [23]
The difference between the 8.9 million figure reported by local media and the 8.7 million given by MAG's spokesperson is about 200,000 people.
- [24]
MAG's public statement came on Thursday 27 August, two days after it was alerted to the intrusion on Tuesday 25 August.
- [25]
A spokesperson told The Yorkshire Post that roughly 8.7 million people were impacted, although they did not provide a date range, and added that in the vast majority of cases the only information accessed was an email address.
- [26]
The Record reported that the three airports handled more than 65 million passengers last year.
- [27]
Security Affairs reported that the three airports combined handled around 54 million passengers last year, and that MAG recently reported a record 66 million passengers across its network.
- [28]
BleepingComputer reported that MAG is the UK's largest airport operator and that Manchester, London Stansted and East Midlands together handle over 66 million passengers yearly.
- [29]
The Record noted that not all of the passengers counted in annual throughput would have interacted with the affected services.
- [30]
8.7 million affected customers is about 13 percent of the 65 million annual passengers reported by The Record, and about 16 percent of the 54 million reported by Security Affairs; on the 65 million figure that is one exposed record for roughly every 7.5 passenger journeys.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comManchester Airports Group says hackers stole travelers' data
2 articles · August 30, 2026
- helpnetsecurity.comManchester Airports Group breached, millions of customers’ data stolen
1 article · August 28, 2026
- infosecurity-magazine.comManchester Airports Group Hit by Cyber Incident
2 articles · September 2, 2026
- securityaffairs.comCyberattack on UK Airport Operator MAG Exposes Data of 8.7 Million Customers Across Three Airports
3 articles · September 4, 2026
- securityweek.comExtortion Group Claims Manchester Airports Group Data Breach
2 articles · September 3, 2026
- therecord.mediaCyberattack on Manchester Airports Group exposes data of 8.7 million customers
1 article · August 27, 2026
Topics and entities
Topics
- Secrets in client-side code
- Aviation Cybersecurity
- Phishing
- Data Breaches
- Data Extortion
Entities
- Manchester Airports Group
- East Midlands Airport
- Manchester Airport
- London Stansted Airport
- Have I Been Pwned