Manchester Airports Group said attackers took customer email addresses, phone numbers, vehicle registration numbers and postcodes. The notice, confirmed on 27 August 2026, affects about 8.7 million customers, as reported by National Cyber Security Consulting the National Cyber Security Consulting breach report. Manchester Airports Group, or MAG, operates Manchester Airport, London Stansted Airport and East Midlands Airport. MAG said airport operations, aviation security and passenger safety were unaffected.
Table of Contents
- Who was affected?
- What was taken — and what was not?
- Where did the data come from?
- How did MAG handle the intrusion?
- What should customers watch for now?
Who was affected?
The breach covers customers of MAG's three airports. CPO Magazine identified them as Manchester Airport, London Stansted Airport and East Midlands Airport the CPO Magazine airport breach report.
The scale is about 8.7 million customers. That makes it one of the largest UK travel-related customer data incidents disclosed in August 2026.
What was taken — and what was not?
MAG said the stolen data included email addresses, phone numbers, vehicle registration numbers and postcodes, according to The Guardian via a CM-Alliance roundup the Guardian roundup of August 2026 attacks. MAG also said the affected system did not hold bank or payment-card details. GRC Report carried MAG's statement that payment data was not involved and operations were unaffected the GRC Report on the MAG cyberattack.
Where did the data come from?
The data came from ancillary customer systems, not core flight operations. MAG pointed to car-park, lounge and Fast Track bookings plus in-airport Wi-Fi sign-ups.
Those sources included device-connection details from Wi-Fi use. That mix explains why contact and vehicle data appear together.
How did MAG handle the intrusion?
MAG said it detected the intrusion on 25 August, contained the risk and brought in specialists. It then notified the ICO, the National Cyber Security Centre and law enforcement.
MAG told the BBC the attackers demanded an undisclosed ransom and that MAG refused to pay. Extortion group FulcrumSec later claimed responsibility.
What should customers watch for now?
Affected customers reported more spam calls after the incident. MAG urged vigilance against phishing calls, texts and links impersonating the airports. Treat unexpected contact that uses your postcode, car registration or travel details with extra caution.
- Do not click links in unexpected airport or parking messages
- Verify sender numbers and email domains before replying
- Never share payment details or one-time codes by phone or text
- Contact the airport through its published website if a message seems urgent
You Might Also Like
- Website Outage vs. Data Breach: Why Downtime Alone Does Not Establish Data Theft
- Legal Aid Agency Data Breach: Questions to Ask if Your Address Was Confidential
- Southern Water Data Breach: What to Keep From Your Notification Letter