Manchester Airports Group says no bank or payment details were compromised in its security incident. The company says neither it nor the accessed system held customers' bank or payment details. Manchester Airports Group, the operator of Manchester, London Stansted and East Midlands airports, said an unauthorised third party accessed data of about 8.7 million customers, according to MAG in its official 27 Aug statement. The company tied the access to a system supporting car parking, lounge, Fast Track and WiFi services.
Table of Contents
- What MAG says about payment details
- What data was taken instead
- Who is affected and what kept working
- Why "no payment data" does not mean no fraud risk
- How to handle suspicious calls, texts and emails
What MAG says about payment details
MAG states the accessed system did not store bank or payment details. That is the basis for its statement that no payment-card data was compromised. The
Data Published: Why the Distinction Matters”>distinction matters
What data was taken instead
MAG says the taken data was limited to contact and related identifiers. Morningstar/Alliance News reports the categories as email addresses, phone numbers, vehicle registration numbers and postcodes from car park, lounge, Fast Track bookings and WiFi sign-ups in its Alliance News report.
Most affected records were narrower. Aviation reporting attributed to PA says most records were restricted to customer email addresses linked to in-terminal WiFi sign-ups. A smaller group therefore carries the wider mix of phone, vehicle and postcode details.
Who is affected and what kept working
The incident spans customers across Manchester, London Stansted and East Midlands airports. The common link is use of the affected booking or WiFi sign-up system, not all airport passengers.
Airport operations were unaffected. Business Travel News Europe reports MAG said passenger safety and aviation security were never compromised and operations continued without disruption.
Why "no payment data" does not mean no fraud risk
The payment assurance has a clear limit. CPO Magazine notes the assurance means that system did not store payment details, not that stolen contact plus vehicle data cannot support convincing fraud or phishing in its 1 Sept analysis.
Attackers can combine an email, phone number, postcode and vehicle registration into a persuasive message. A note mentioning a real airport booking, car park use or number plate deserves extra scrutiny. Readers should not use the absence of card loss as a reason to trust follow-up contacts.
How to handle suspicious calls, texts and emails
MAG says it will never contact customers unexpectedly for payment, banking details or passwords. Customers should treat unexpected requests for that information as fraudulent, according to the Manchester Airport notice reported via the Oldham Times in its breach notice report.
- Pause on any unexpected call, text or email mentioning airport bookings and payment.
- Do not share card numbers, bank logins, one-time codes or passwords.
- Contact the airport, lounge, parking or airline through a known number or official site instead of using links or callback numbers in the message.
You Might Also Like
- Stansted and East Midlands Data Breach Notices: How They Connect to Manchester Airports Group
- Manchester Airports Group Data Breach: How to Check a Supposed Refund Message
- Manchester Airport Data Breach: Are Existing Parking and Lounge Bookings Still Valid?