Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal
Summary
Data from Manchester Airports Group was leaked after it refused to pay a ransom. HaveIBeenPwned analyzed the dataset and reported about 8.8 million email addresses and phone numbers among the exposed information.
Key points
- MAG disclosed that hackers breached its systems and stole booking and Wi-Fi sign-up data from Manchester, London Stansted, and East Midlands airports; it said operations were unaffected.
- Exposed information includes email addresses, phone numbers, vehicle registrations, postcodes, names, browser details, and purchases.
- HaveIBeenPwned parsed the dataset and reported approximately 8.8 million email addresses and phone numbers.
- FulcrumSec claimed responsibility and published roughly 550 GB of data it said was stolen from MAG.
- FulcrumSec claimed it used admin keys left in frontend JavaScript on the airports’ websites; SecurityWeek said it had not independently verified the attackers’ claims.
- The group said MAG did not pay its ransom demand.
Article Details
- Victim Organization
- Manchester Airports Group (MAG)
- Incident Type
- Data breach and extortion involving theft and online publication of booking and airport Wi-Fi sign-up data.
- Data Types Exposed
- Email addresses
- Phone numbers
- Names
- Vehicle registration plates
- Postcodes and postal regions
- Town information
- Residential IP addresses
- Browser agent details
- Purchase and booking data
- SMS messages associated with bookings, car parks, and vehicle registration
- MAG platform configuration (claimed by FulcrumSec; not independently verified)
- Affected Records
- Approximately 8.8 million email addresses and phone numbers were reported compromised by HaveIBeenPwned. FulcrumSec claimed data relating to roughly 8.7 million individuals; the article does not establish that these figures represent distinct records.
- Affected Data Size
- FulcrumSec claimed to have published roughly 550 GB of uncompressed data.
- Operational Impact
- MAG said its operations were not affected.
- Ransom Or Extortion
- MAG confirmed receiving a ransom demand. FulcrumSec said MAG did not pay. The group claimed responsibility and published data it said was stolen; SecurityWeek had not independently verified the group's claims.
- Claim Status
- confirmed