Egidio

The Threat Laboratory → Manchester Airports

Case file · 11 September 2026

Manchester Airports: 8.7 million customers, and a dispute over how

Manchester Airports Group confirms 8.7 million customers exposed. A researcher traced the cause to an API key left in public JavaScript since 2022 — MAG disputes that framing directly. Confirmed, disputed and claimed, kept apart.

Protect my phone with Egidio Free for calls · 100% on your phone · no account needed
⚠️ Three separate claims, three separate levels of certainty. What Manchester Airports Group (MAG) confirms about the breach itself is solid. How it happened, and how much was taken, is genuinely disputed — between the company and an independent researcher. This dossier keeps the three apart.

What MAG confirms

8.7M
Customers affected, confirmed by MAG on 27 August 2026. Most had only an email address exposed.
MAG statement, cited by BleepingComputer. Accessed 11/09/2026.
4
Data categories confirmed by MAG : email addresses, phone numbers, vehicle registrations, postcodes — from Wi-Fi sign-ups and car park, lounge and Fast Track bookings.
MAG statement, BleepingComputer, 09/2026.
0
Bank or payment details held in the affected system, per MAG. Airport operations and aviation security were not affected.
MAG statement, 09/2026.
86GB
Volume claimed stolen by the extortion group FulcrumSec — MAG has declined to confirm or deny this figure, the exposed-credential mechanism, or the future-travel records claim.
FulcrumSec, reported by BleepingComputer. Not confirmed by MAG.

🔑The disputed part : a hack, or a four-year-old key?

Security researcher Scott Helme used the Internet Archive's Wayback Machine to trace a 32-character Iterable API key sitting in plain sight inside MAG's public-facing JavaScript — present, unchanged, from a June-July 2022 rollout until it was still there in August 2026. His conclusion : "FulcrumSec just happen to be the ones who told us" it was accessible. MAG disputes this framing directly, telling press it was "a hack, not a lapse," and maintaining it was the victim of a sophisticated crime. Both the archived JavaScript and MAG's rejection of the "no hacking required" characterisation are independently verifiable — this dossier reports both without picking a side.

Scott Helme, technical analysis, 09/2026 — cross-checked by The Register.

Timeline

CONFIRMED
June–July 2022
An Iterable API key appears in MAG's public JavaScript during a platform rollout. Archived snapshots show it unchanged for the next four years.
CLAIMED
Before 2 September 2026
FulcrumSec claims to have used the exposed key to access MAG systems and demands a ransom. MAG confirms it refused to pay.
CONFIRMED
27 August 2026
MAG confirms unauthorised access to customer data linked to Manchester, London Stansted and East Midlands airports — 8.7 million customers.
CLAIMED
2 September 2026
FulcrumSec publishes the stolen data on its leak site, a week after MAG's refusal to pay — 86GB compressed, which the group later told BleepingComputer expands to roughly 640GB, including close to 200,000 records tied to upcoming 2026 travel.

What it means for you

If you've used airport Wi-Fi, parking, a lounge or Fast Track at Manchester, Stansted or East Midlands since 2022, your email and possibly your phone number, vehicle registration or postcode may have been exposed. Watch for messages that reference a real booking or car park visit to ask for payment or login details — no airport service asks for that by email or SMS.

🔒 MAG states no bank or payment details were held in the affected system. A message asking you to "confirm" card details over a Manchester Airports breach is, for that reason alone, not legitimate.

Frequently asked questions

Is the Manchester Airports breach confirmed?

Yes — MAG confirmed unauthorised access to 8.7 million customer records on 27 August 2026. What remains disputed is how it happened and exactly how much was taken.

Was it really "no hacking required"?

A researcher's Wayback Machine analysis shows an API key exposed in public JavaScript since 2022. MAG disputes this characterisation and describes the incident as a sophisticated hack, not a lapse. Both claims are reported here without a verdict.

Were bank details stolen?

No, according to MAG. The affected system did not hold bank or payment information.

📌 Last checked: 11 September 2026. Verifiable correction: contact@egidio.app.

Read next

UK data breaches: what the ICO records Back to the Threat Laboratory All our sources
Cite this page Egidio — Threat Laboratory, « Manchester Airports: 8.7 million customers, and a dispute over how », egidio.app/en-gb/laboratoire/manchester-airports-api-key-breach/. CC BY 4.0.

Free to reuse, including commercially, with attribution. Reuse terms.

Sources. The Register, Scott Helme (independent researcher) and BleepingComputer, September 2026. MAG's confirmed figures and its dispute of the "lapse" framing are both cited from these reports. Checked 11/09/2026.