← News
/DISPATCH · 2026-09-04

Manchester Airports Group: 8.7 Million Customer Records Leaked; FulcrumSec Publishes Half a Terabyte After Ransom Refusal

UK Manchester Airports Group confirms a breach affecting about 8.7 million customers. Ransomware group FulcrumSec claims 86GB stolen and, after ransom refusal, published about half a terabyte of customer data. Suspected entry: Iterable API credentials exposed in front-end JavaScript.

Manchester Airports Group (MAG), operator of Manchester, London Stansted, and East Midlands airports, confirmed a large data breach affecting about 8.7 million customers. Ransomware group FulcrumSec claims it stole about 86GB. After MAG refused the ransom, the group published about 0.5TB. Third parties verified authenticity.

Incident overview

MAG first disclosed on 27 August: stolen data sat in a third-party-hosted database covering parking, lounges, fast-track bookings, and airport Wi-Fi registration. Fields include email, phone, license plate, postcode, and name. MAG says payment-card and bank data were not involved; flight operations and aviation safety were unaffected. FulcrumSec then posted the data on its leak site. Have I Been Pwned analysis puts unique users at about 8.7 million, with browser info, IP addresses, geolocation, and purchase history among the fields.

Technical details

FulcrumSec claims the path was not sophisticated: MAG front-end JavaScript embedded marketing-platform Iterable API credentials. Attackers used those credentials against the customer data platform. Iterable’s own security docs warn that server-side API keys must never ship in browser code, and that client keys are limited and should pair with JWT auth. Neither MAG nor Iterable confirmed key type or privilege scope. The group also claims about 200,000 remaining-2026 travel-plan records, and names NHS staff, MPs, and public figures. Those claims are not independently verified.

Impact

Textbook third-party risk plus broken front-end credential hygiene: attackers never touched core airport systems, yet quietly took tens of millions of customer records via the marketing layer. After publication, name + phone + real travel history supports high-confidence phishing and fraud: fake parking refunds, unpaid drop-off fines, and similar. FulcrumSec has run steal-and-extort operations since 2025 against LexisNexis, Novo Nordisk, Avnet, and others. Active double-extortion crew.

Remediation

Sources