Full Report
What HappenedOn 25 August 2026, Manchester Airports Group (MAG), the operator of Manchester Airport, London Stansted Airport, and East Midlands Airport, reported they recently suffered data breach.Personal information belonging to approximately 8.7 million customers was reportedly accessed. The majority of affected records involve email addresses collected via in-airport Wi-Fi sign ups, alongside customer data from car parking, airport lounge, and Fast Track security bookings.According to BBC reports, the cybercriminals behind the attack issued a ransom demand to MAG. MAG said it had to temporarily suspended access to its online "Manage My Booking" service but importantly said that passenger safety, aviation security, and flight operations remained uncompromised and operated normally.On 30 August, the MAG breach was then claimed by an known data extortion group called FulcrumSec, which told BleepingComputer that it stole approximately 86 GB of data. The FulcrumSec group claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript and that the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026.Analyst Comment This breach highlights a common cyber risk pattern around secondary customer services (Wi-Fi portals, parking systems, lounge bookings) often present softer targets than core operational networks. While MAG’s air traffic control and aviation security systems remained segregated and secure, external customer-facing web applications harboured large volumes of Personally Identifiable Information (PII). Although the no payment card details were stolen, the exfiltrated dataset (email, phone, home postcode, vehicle registration) is ideal for tailored targeted phishing and smishing (SMS scams) campaigns, as well as identity theft fraud.The ransom demand cited by the BBC and claims by FulcrumSec reflects the modern trend of cybercriminals increasingly focus on exfiltrating sensitive PII for extortion, monetising stolen data foregoing the need to encrypt internal infrastructure and cause operational downtime.The reason MAG’s system was exploited was allegedly due to exposed API credentials in client-side JavaScript. Notably, this is a well-known TTP of FulcrumSec who has stated they leveraged the same issue to target Arup. While many cybercriminals utilise stolen PII for financial fraud and phishing, state-sponsored advanced persistent threat (APT) groups are likely to also look to exploit this specific combination of datasets as a goldmine for espionage, counter-intelligence, surveillance, and strategic targeting.Defensive Takeaways Hunt for Credential Exposure: FulcrumSec has had success multiple times identifying exposed credentials in web app code. Arup Group was also victimised this way. This highlights the importance of thorough and continuous testing during active development and changes pushed to production environments. A basic procedural review of the application’s security could have caught and mitigated this issue.Review Your Security Architecture: This breach highlighted the importance of segregated ancillary web platforms (such as guest Wi-Fi and parking reservation tools) from core networks. Due to segregation, MAG was able to suspend certain portals while keeping core business operations running without significant disruption.Proactive Public Communication: MAG did well to proactively issue clear public guidance advising customers on what was and was not taken, helping mitigate downstream fraud risk before attackers exploit the data and before the threat actors publicly claimed the breach.Relevant Sourceshttps://www.bbc.co.uk/news/articles/c7v4353rry7ohttps://www.manchesterairport.co.uk/help/data-security-incident/https://www.bleepingcomputer.com/news/security/fulcrumsec-claims-manchester-airports-hack-theft-of-86-gb-of-data/https://ico.org.uk/media/action-weve-taken/mpns/2618421/ba-penalty-20201016.pdfhttps://scotthelme.co.uk/no-hacking-required-manchester-airports-group-data-breach/Relevant CTI Sourceshttps://blog.bushidotoken.net/2026/06/uk-cybercrime-journal-arup-group.htmlhttps://www.ransomware.live/group/fulcrumsechttps://haveibeenpwned.com/Breach/ManchesterAirportsGroup
Analysis Summary
# Incident Report: Manchester Airports Group Data Exfiltration
## Executive Summary
On August 25, 2026, Manchester Airports Group (MAG) reported a significant data breach involving the exposure of personal information belonging to approximately 8.7 million customers. The threat actor, FulcrumSec, exploited exposed API credentials in client-side JavaScript to exfiltrate 86 GB of data from secondary customer-facing systems. While passenger operations and aviation security remained unaffected due to network segregation, the stolen data poses a high risk for targeted phishing and identity theft.
## Incident Details
- **Discovery Date:** August 25, 2026 (Public reporting date)
- **Incident Date:** Recently occurred prior to August 25, 2026
- **Affected Organization:** Manchester Airports Group (MAG) - including Manchester, London Stansted, and East Midlands airports.
- **Sector:** Aviation / Transportation
- **Geography:** United Kingdom
## Timeline of Events
### Initial Access
- **Date/Time:** Preceding August 25, 2026
- **Vector:** Exploitation of exposed credentials
- **Details:** The threat actor obtained airport-specific **Iterable API credentials** that were improperly left exposed within client-side JavaScript code on MAG websites.
### Lateral Movement
- **Details:** Not explicitly detailed, but the breach was confined to ancillary web platforms (Wi-Fi portals, parking, and lounge booking systems) which were architecturally segregated from the core aviation operational network.
### Data Exfiltration/Impact
- **Details:** FulcrumSec exfiltrated approximately **86 GB of data**. This included 8.7 million customer records (emails, phone numbers, postcodes, vehicle registrations) and 200,000 specific records relating to upcoming travel for the remainder of 2026.
### Detection & Response
- **Discovery:** Reported by MAG on August 25; later claimed by FulcrumSec on August 30 via BleepingComputer.
- **Response Actions:** MAG proactively disclosed the breach, issued a ransom refusal (implied by public reporting), and suspended the "Manage My Booking" online service to contain the incident.
## Attack Methodology
- **Initial Access:** Valid Accounts (Exploitation of API keys exposed in public-facing code).
- **Persistence:** Not disclosed.
- **Privilege Escalation:** Not disclosed.
- **Defense Evasion:** Use of legitimate API credentials to blend with normal traffic.
- **Credential Access:** Stolen via client-side JavaScript scraping.
- **Discovery:** Identification of sensitive API keys in web application source code.
- **Lateral Movement:** Limited by network segregation.
- **Collection:** Automated gathering of PII from databases linked to the Iterable API.
- **Exfiltration:** Data exfiltration over Command and Control (C2) or API channels (86 GB total).
- **Impact:** Data theft and subsequent extortion attempt.
## Impact Assessment
- **Financial:** Potential regulatory fines from the ICO; costs associated with incident response and the suspension of booking services.
- **Data Breach:** High. 8.7 million records including PII (Emails, phone numbers, vehicle registrations). No payment card data was compromised.
- **Operational:** Minimal for core business. Flight operations, aviation security, and ATC were unaffected. Online booking services were temporarily suspended.
- **Reputational:** Moderate to High. Significant media coverage (BBC, BleepingComputer) regarding the scale of customer data loss.
## Indicators of Compromise
- **Network indicators:** API calls originating from unauthorized or anomalous IP addresses targeting the Iterable API endpoint.
- **File indicators:** None provided in the context.
- **Behavioral indicators:** Unauthorized scraping of PII; anomalous volume of data (86 GB) egressing via marketing/booking APIs.
## Response Actions
- **Containment measures:** Temporary suspension of the "Manage My Booking" portal.
- **Eradication steps:** Rotation and securing of exposed Iterable API credentials.
- **Recovery actions:** Proactive public communication and guidance to affected customers regarding phishing risks.
## Lessons Learned
- **Credential Management:** Hardcoding or exposing API keys in client-side code remains a critical vulnerability that threat actors like FulcrumSec actively hunt for.
- **Network Segregation:** The decision to segregate ancillary services from core flight operations prevented a safety crisis, turning a potential disaster into a manageable data breach.
- **Third-Party Risk:** Security depends not just on internal code, but on how third-party marketing and communication APIs (like Iterable) are implemented.
## Recommendations
- **Automated Scanning:** Implement automated secrets detection tools (e.g., GitGuardian, TruffleHog) in the CI/CD pipeline to prevent API keys from reaching production.
- **Code Reviews:** Conduct rigorous security-focused code reviews for all client-side JavaScript.
- **Least Privilege:** Ensure API keys are restricted by IP or specific functionality so that if leaked, the scope of access is limited.
- **Monitoring:** Set up alerts for anomalous data export volumes through third-party marketing APIs.
***
**Relevant Sources (Defanged):**
- hxxps[://]www[.]bbc[.]co[.]uk/news/articles/c7v4353rry7o
- hxxps[://]www[.]bleepingcomputer[.]com/news/security/fulcrumsec-claims-manchester-airports-hack-theft-of-86-gb-of-data/
- hxxps[://]blog[.]bushidotoken[.]net/2026/09/uk-cybercrime-journal-manchester[.]html