Airport group reportedly exposed overprivileged API keys in client-side JavaScript for four years

A security researcher, Scott Helme, reconstructed how an extortion group allegedly stole 8.8 million customer records from Manchester Airports Group (MAG). The attack exploited API keys for Iterable, a marketing automation platform, that were embedded in client-side JavaScript. The keys were exposed for four years, from June 2022 to August 2026, and could be extracted by anyone examining the page source. This contradicts MAG’s claim of a 'sophisticated' hack, as the credentials were publicly accessible without requiring any breach of MAG’s infrastructure.

The API keys were not only exposed but also overprivileged. They granted read/write access to core Iterable endpoints, far beyond what was needed for their intended use, attributing page clicks to marketing emails. This allowed access to customer profiles, booking details, and even endpoints capable of deleting records or rewriting profiles. Helme noted that while the extortion group did not appear to have used these destructive capabilities, the exposure created a catastrophic risk: the ability to 'nuke everything from orbit' was available to anyone who viewed the source code.

The incident highlights systemic failures in credential management and access control. Iterable’s documentation explicitly warns against using API keys in client-side code, yet MAG’s implementation ignored this guidance. The keys should have been restricted to server-side use, where they could be kept secret and access could be monitored. The four-year exposure window also raises questions about MAG’s ability to detect or audit such vulnerabilities, as the researcher noted that MAG may not even have retained four years of Iterable API logs to investigate who else might have accessed the keys.

MAG’s response to the incident has been defensive, describing the attack as a 'sophisticated hack' rather than a preventable lapse. The company disputes Helme’s characterization of the incident as requiring 'no hacking,' instead framing it as a crime. However, the researcher’s findings suggest that the exposure was a self-inflicted vulnerability, not an external breach. The extortion group’s relatively low ransom demand further complicates MAG’s narrative, as it suggests the attackers may have viewed the exploit as trivial rather than the result of advanced techniques.