Full Report
FulcrumSec claims it stole 86 GB of data from Manchester Airports Group. BleepingComputer validated one traveller's record, while samples revealed detailed customer, booking, and travel information beyond what MAG initially disclosed. [...]
Analysis Summary
# Incident Report: Manchester Airports Group Data Extortion
## Executive Summary
Manchester Airports Group (MAG) suffered a significant data breach involving the theft of approximately 86 GB of customer data by the extortion group FulcrumSec. The breach, facilitated by exposed API credentials, compromised detailed travel, booking, and personally identifiable information (PII) for approximately 8.7 million customers. While no operational disruptions occurred, the depth of the data—including upcoming travel plans—poses a high risk for targeted phishing and physical security concerns.
## Incident Details
- **Discovery Date:** August 27, 2026 (Public Disclosure)
- **Incident Date:** Ongoing/Detected August 2026
- **Affected Organization:** Manchester Airports Group (MAG)
- **Sector:** Aviation / Transportation
- **Geography:** United Kingdom (Manchester, London Stansted, and East Midlands airports)
## Timeline of Events
### Initial Access
- **Date/Time:** Circa August 2026
- **Vector:** Exploitation of exposed credentials.
- **Details:** Attackers obtained airport-specific **Iterable API credentials** that were inadvertently exposed in client-side JavaScript on MAG-controlled websites.
### Lateral Movement
- **Details:** Using the stolen API credentials, the attackers moved from the web front-end to the backend marketing and customer engagement platform (Iterable) to access consolidated customer databases.
### Data Exfiltration/Impact
- **Details:** Approximately 86 GB of data was exfiltrated. This included a 21.5 GB export of Manchester customer profiles containing PII, historical booking activity, vehicle registrations, and specific details for ~200,000 upcoming trips in 2026.
### Detection & Response
- **Detection:** Disclosed by MAG on August 27; validated by BleepingComputer via data samples provided by the threat actor.
- **Response:** MAG contacted affected customers, specifically targeting those with upcoming bookings, and issued public warnings regarding phishing.
## Attack Methodology
- **Initial Access:** Valid Accounts (Exposed API Keys in client-side code).
- **Persistence:** Not explicitly detailed; likely maintained via API access until credentials were revoked.
- **Privilege Escalation:** Not disclosed; access granted by the API key was sufficient for data export.
- **Defense Evasion:** Use of legitimate API credentials to blend in with authorized administrative or automated traffic.
- **Credential Access:** Insecure storage/exposure of credentials in JavaScript.
- **Discovery:** Web application reconnaissance to identify exposed keys.
- **Lateral Movement:** Not applicable in the traditional network sense; lateral movement occurred between the web infrastructure and the third-party marketing platform.
- **Collection:** Automated export of consolidated customer profiles and booking databases.
- **Exfiltration:** Transfer of 86 GB of data to attacker-controlled infrastructure.
- **Impact:** Data Extortion (Threatening to publish sensitive travel and PII).
## Impact Assessment
- **Financial:** Potential for significant GDPR fines (ICO) and costs related to victim notification and credit monitoring.
- **Data Breach:** 86 GB of data; 8.7 million customers affected. Data includes PII, full UK postcodes, vehicle registrations, and precise travel itineraries.
- **Operational:** Low; no impact on flight operations or aviation security.
- **Reputational:** High; largest known data breach of a UK airport operator. Discrepancy between initial MAG disclosure and the depth of data revealed by the hackers.
## Indicators of Compromise
- **Network indicators:** API calls to `Iterable` endpoints originating from unauthorized/non-MAG IPs (Defanged: hxxps[://]api[.]iterable[.]com).
- **File indicators:** `Manchester_customer_export.csv` (or similar 21.5 GB database export).
- **Behavioral indicators:** Unusual volume of data exported via marketing API keys during non-maintenance windows.
## Response Actions
- **Containment:** Revocation of exposed API credentials and hardening of client-side JavaScript.
- **Eradication:** Removal of exposed keys from public-facing code.
- **Recovery:** Notifying 8.7 million affected individuals; providing specific support to 200,000 travellers with upcoming bookings.
## Lessons Learned
- **Credential Hygiene:** API keys and sensitive secrets must never be hardcoded or exposed in client-side JavaScript (front-end code).
- **Scope of Disclosure:** Initial incident assessments may underestimate the breadth of a breach; transparency is critical to maintaining public trust.
- **Third-Party Risk:** Data stored in third-party marketing or engagement platforms (like Iterable) is just as sensitive as data in primary databases and requires equivalent security controls.
## Recommendations
- **Secret Management:** Implement automated scanning (e.g., GitLeaks, Trufflehog) to detect secrets in code before deployment.
- **Least Privilege:** Ensure API keys are scoped to the minimum permissions required (e.g., a key used for front-end analytics should not have permissions to export entire databases).
- **Monitoring:** Implement anomaly detection for API usage to alert on large-scale data exports or unusual access patterns.
- **Data Minimization:** Review the necessity of storing historical travel and device data in accessible marketing platforms.