Manchester Airports Group reports hackers stole contact and vehicle data of up to 8.7 million customers

Manchester Airports Group (MAG) confirmed a data breach affecting up to 8.7 million customers across its three UK airports. The stolen data includes contact details, postcodes, and vehicle registration numbers, all tied to non-flight services such as car parking, lounge reservations, Fast Track bookings, and Wi-Fi sign-ups. This focus on ancillary services rather than core aviation systems suggests attackers targeted lower-priority but data-rich systems that may have weaker security controls. The absence of payment data in the breach indicates either a deliberate choice by attackers or a successful segmentation of financial systems from customer databases.

The operational impact of the breach appears minimal, with no reported flight cancellations, terminal disruptions, or aviation security incidents. This contrasts with the significant risk posed to affected customers, as the stolen data enables highly personalized phishing and smishing attacks. Attackers can now craft messages referencing real customer trips, vehicle registrations, or booking details, making fraudulent communications far more convincing. The risk extends beyond UK travelers, as the data includes information on international customers who used MAG’s airports. The lack of disclosure about how the breach occurred or whether the data has been published leaves open questions about the attack’s sophistication and the attackers’ motives.

MAG’s response has focused on containing the breach and cooperating with authorities, but the company has not provided details about the attack vector, timeline, or whether all 8.7 million records were exfiltrated. This lack of transparency limits the ability of other organizations to learn from the incident. Security experts warn that the breach reflects broader pressure on the aviation sector, where interconnected systems and third-party suppliers create vulnerabilities. The incident underscores the need for aviation companies to extend their security perimeters to include all customer-facing digital services, not just flight operations. For engineers, this breach serves as a reminder that even non-core systems can become high-value targets if they hold large volumes of customer data.

The immediate advice for affected customers is to treat unsolicited communications about airport services with suspicion, particularly those referencing real trips or bookings. MAG recommends verifying any such messages by contacting the airport directly through official channels. The breach also highlights the risks of data reuse, as stolen contact details could be cross-referenced with other breaches to target customers with reused passwords. While the operational impact of the breach is limited, the long-term risk lies in how attackers may weaponize the stolen data, potentially leading to AI-enhanced extortion or blackmail campaigns. This incident may prompt other aviation and travel companies to reassess their own security postures, particularly around customer-facing digital services.