FulcrumSec claims theft of 86 GB of data from Manchester airports operator

The extortion group FulcrumSec has told BleepingComputer that it was behind the breach of Manchester Airports Group (MAG) — the UK's largest airports operator — and that it stole roughly 86 GB of data. As proof, the attackers handed reporters samples of the stolen information.

What has been confirmed

On 27 August, MAG reported that an unknown third party had stolen customer data from the airports in Manchester, London Stansted and East Midlands. According to the company, this involved bookings for parking, lounges and the Fast Track service, as well as airport Wi‑Fi registrations.

BleepingComputer verified one record by cross-checking it against a particular traveller's actual purchase history: it exactly matched their past Fast Track purchases, the booking and arrival times, the terminal used, the amounts paid, the purchase references and the total spend. The Manchester customer export alone came to about 21.5 GB and contained aggregated profiles linking customer identifiers with booking histories and marketing tags.

How access was obtained

According to FulcrumSec, access was gained through API credentials for the Iterable service, tied to specific airports and left exposed in client-side JavaScript. The group claims that the stolen data includes almost 200,000 records of trips scheduled for the rest of 2026, with dates, times and links to personal data. That said, FulcrumSec is considering not publishing these records because of the risk of “real harm” to people.

It was not possible to independently confirm the source, the extent of access or the number of future-trip records. After verification, BleepingComputer permanently deleted all the material provided.

The scale turned out to be broader

The samples contained noticeably more than MAG had admitted: in addition to emails, phone numbers, licence plate numbers and postcodes — booking references, chosen services and prices, discounts, statuses, parking dates and times, spending history, IP addresses, approximate geolocations and device data. There was no payment or banking information in the samples examined.

The danger is that a British postcode, unlike an American ZIP code, points to a very narrow set of addresses — on average around 15, according to the ONS, and sometimes to a single house. Combined with contact and travel data, this makes it possible to craft convincing phishing emails and calls purporting to come from MAG or a booking service.

MAG's response

The company declined to comment on the hackers' specific claims, referring to an updated statement: all those affected, including customers with upcoming bookings, have been notified. According to BleepingComputer, the extortionists demanded a ransom, but MAG refused to pay. The incident did not affect airport operations or flight safety.

MAG had earlier cited a figure of around 8.7 million affected customers, though for the “vast majority” only email addresses were exposed. That makes the case the largest known customer data breach at a British airports operator.

Source: Bleeping Computer