Manchester Airports breach: customer data reportedly released online

Independent research has corroborated a years-long exposure of API credentials in client-side code used by Manchester Airports Group, supporting a plausible route to customer records without establishing the cause of the confirmed breach.

As of 9 September 2026, however, the evidence does not establish that the complete dataset was publicly released, that the exposed credentials were used in the intrusion or that the self-identified FulcrumSec group carried it out. The scale of the breach has not been independently established.

Customer data taken across three airports

MAG disclosed on 27 August that an unauthorised third party had obtained customer information from systems associated with Manchester, London Stansted and East Midlands airports. The affected systems supported car park, airport lounge and Fast Track bookings, as well as sign-ups for in-airport Wi-Fi.

The airport operator identified email addresses, phone numbers, vehicle registrations and postcodes among the accessed information. It said neither MAG nor the affected system held customers’ bank or payment details.

TechRadar subsequently reported, citing a MAG spokesperson, that approximately 8.7 million customers were affected and that only an email address was exposed for the vast majority. That estimate did not appear in MAG’s public incident notice, which provided no numerical total or breakdown by airport, service or data category.

No complete independent assessment has established the full size of the alleged dataset or how many people it represents.

Exposed credentials offer a plausible lead

MAG has not disclosed the forensic root cause of the breach. FulcrumSec claimed, in material reported by BleepingComputer, that airport-specific credentials for the Iterable API had been embedded in client-side JavaScript and enabled access to customer information.

Security researcher Scott Helme later provided independent corroboration for an important part of that account. His investigation found three airport-specific Iterable API credentials in archived client-side code dating from mid-2022 through August 2026. He also documented code interacting with user-profile functionality and found that the integrations had been disabled by the time of his September investigation.

Those findings establish that credentials were exposed in client-side code over a prolonged period. They do not prove that FulcrumSec used those credentials, that they provided the only access route or that Iterable’s own service was compromised. MAG has not confirmed the integration as the cause of the breach.

The research nevertheless raises a broader governance problem for organisations handling sensitive customer information. Customer-engagement and marketing integrations can sit outside operational infrastructure while retaining access to valuable records. Their separation from systems controlling flights or airport safety does not remove the privacy risk created by poorly protected credentials.

Sample validation falls short of confirming the full claims

FulcrumSec has claimed responsibility for the incident and alleged that it obtained about 86 GB of compressed data, including records concerning upcoming travel. MAG has not named an attacker, and no government or law-enforcement attribution was identified in the reviewed material.

BleepingComputer reported that it validated one sampled passenger record against a real traveller’s known Manchester Airport purchase history. That check lends support to the authenticity of at least some material associated with the claim, but it does not authenticate the alleged archive, its volume, the number of affected customers or the identity of the people behind the intrusion.

It also leaves a difference between the broad categories MAG disclosed and the more granular booking and purchase context suggested by the validated sample and FulcrumSec’s claims. MAG has not publicly reconciled those descriptions or confirmed that records about future travel were taken.

TechRadar reported on 2 September that stolen material had been posted or offered online after a failed extortion attempt. ITPro separately reported the alleged publication the following day. The available evidence does not resolve whether the complete dataset was freely published, privately distributed or offered for sale, and MAG has not confirmed the reported sequence of an unsuccessful extortion attempt followed by release.

No airport disruption, but customer risks remain

The incident had no reported effect on flights, airport operations, customer parking services, passenger safety or aviation security. MAG said upcoming bookings remained valid and advised passengers to continue travelling normally. That operational outcome separates the breach from an attack on core airport systems, but it does not diminish the exposure of customer information.

Contact details combined with postcodes, vehicle registrations and travel-service context could help criminals construct convincing phishing or impersonation messages. There is no confirmed evidence in the reviewed material that customers have suffered fraud, identity theft or other downstream harm because of the breach.

MAG has advised affected customers to watch for suspicious emails, text messages and calls, and to avoid links or attachments in unexpected communications. It also said it would not unexpectedly request payment-card details, banking information or passwords.

The group said it restricted access to affected systems, contained the immediate risk, engaged specialist cybersecurity advisers, notified relevant authorities and contacted affected customers. Helme found that the exposed API credentials had been disabled by late August, but MAG has not published full remediation details covering credential rotation, access-control changes, log reviews or any independent security audit.

Key questions therefore remain open: when access began, how long it continued, how MAG detected it, which route the intruder used and how widely the information has been distributed. There is also no Australia-specific victim count. Australians who used the affected services could be included, while the wider lesson for Australian aviation and critical-infrastructure operators concerns the governance of customer data accessible through client-side secrets and third-party engagement systems.

Exposed client-side credentials show why customer-engagement integrations merit security scrutiny even outside core operational systems. Readers interested in the wider security concepts can turn to The Hack Academy’s online cybersecurity training programme, which offers self-paced learning with practical exercises alongside theory and lists internet vulnerabilities, networking and cybersecurity fundamentals among its subject areas.