Hackers Steal Data of 8.7 Million Customers in Cyberattack on Three UK Airports

A cyberattack against three major UK airports has exposed data belonging to approximately 8.7 million customers, raising fresh concerns about the security of customer-facing systems used across critical infrastructure. The incident affected Manchester Airport, London Stansted Airport, and East Midlands Airport, all operated by Manchester Airports Group (MAG).

The attackers accessed information connected to airport Wi-Fi registrations, car parking, lounge and Fast Track bookings.

This wasn’t an attack that shut down runways or grounded aircraft. It was something potentially more scalable: A large-scale customer data compromise inside a critical infrastructure organisation.

---

What Happened?

Manchester Airports Group confirmed that it had suffered a cybersecurity incident involving an unauthorised third party. MAG said it became aware of the incident on August 25, 2026, while the intrusion itself is believed to have occurred several days earlier. The affected systems contained customer information associated with:

• Airport Wi-Fi registrations
• Car park bookings
• Lounge bookings
• Fast Track bookings

Approximately 8.7 million customers are believed to have been affected. However, the 8.7 million figure requires some context. The majority of affected customers reportedly had only their email addresses accessed, particularly information collected through airport Wi-Fi registrations. Other customers had additional information exposed.

---

What Data Was Accessed?

The information currently confirmed as compromised includes:

• Email addresses
• Phone numbers
• Vehicle registration numbers
• Postcodes

MAG has stated that neither the organisation nor the affected system held customers' bank or payment information. There is also no indication that passport information or aviation-security information was accessed. That significantly changes the nature of the incident. This isn't currently a case of attackers stealing millions of payment cards. Instead, it is a large-scale personal-data exposure that could enable highly targeted social engineering and phishing attacks.

---

Why Airport Wi-Fi Data Matters

At first glance, an email address collected through airport Wi-Fi might not sound like particularly sensitive information.

The problem is scale. Millions of legitimate email addresses create a valuable dataset for attackers. And when those addresses are associated with an airport, they can provide useful context for targeted scams. An attacker could potentially send messages pretending to be related to:

• Airport Wi-Fi
• Parking reservations
• Lounge bookings
• Fast Track services
• Refunds
• Travel disruptions

A generic phishing email says:

"Your booking has an issue."

A targeted phishing email can say:

"There is a problem with your airport parking reservation."

That difference matters. Context makes phishing more believable.

---

How the Attack Could Be Used Against Customers

The immediate risk for affected customers isn't necessarily direct financial theft. It is the potential for follow-on attacks.

• Phishing: Attackers can use exposed email addresses to send messages impersonating airport services.
• Smishing: If phone numbers were exposed, attackers can move the same strategy to SMS.
• Social Engineering: Postcodes, vehicle registrations and booking-related information can provide additional context when attempting to impersonate legitimate airport services.
• Credential Theft: A fake airport notification could redirect a victim to a fraudulent login page designed to capture passwords.
• Account Takeover: If stolen credentials are reused elsewhere, attackers could potentially move from a phishing campaign into broader account compromise.

This is why leaked information doesn't necessarily need to contain passwords to become dangerous.

---

The Attack Did Not Disrupt Airport Operations

Despite the scale of the breach, airport operations continued normally. MAG said:

• Passenger safety was not compromised
• Aviation security was not compromised
• Airport operations were unaffected
• Parking services continued operating

The affected customer systems were separate from the systems responsible for core aviation operations. This distinction is important. A successful attack against an airport doesn't automatically mean that aircraft systems have been compromised. Modern airports operate enormous technology environments containing everything from operational technology to customer portals and Wi-Fi systems. The attack appears to have remained focused on the customer-data side of that environment.

---

Why This Is Concerning

The incident highlights a security problem that extends beyond airports. Critical infrastructure organisations often have multiple layers of technology:

• Operational systems
• Corporate networks
• Customer applications
• Booking platforms
• Wi-Fi infrastructure
• Payment services
• Third-party integrations
• Cloud environments
• Marketing databases

Not every system is equally critical to physical operations. But that doesn't mean every system has the same security importance. A system that doesn't control an aircraft can still contain millions of valuable records. And attackers only need one sufficiently exposed system to create a major incident.

---

The 8.7 Million Figure Needs Context

The headline number is massive. But it does not mean that 8.7 million people had every piece of personal information stolen. MAG has indicated that the majority of affected customers had only their email address compromised. Additional information such as:

• Phone numbers
• Vehicle registrations
• Postcodes

was accessed for some customers. The exact breakdown of how many customers had each category of information accessed has not been publicly disclosed.

So the most accurate description is: Approximately 8.7 million customer records were affected, with the majority reportedly involving email addresses rather than complete customer profiles.

---

What About Ransomware?

Despite reports of extortion activity surrounding the incident, MAG has indicated that this was not a ransomware attack involving encryption of airport systems.

Instead, the incident centred around the theft of customer information. This represents a broader trend in cybercrime. Attackers increasingly don't need to encrypt systems. They can simply steal data and threaten to release, sell or exploit it. This model is commonly referred to as data extortion.

For an organisation holding millions of customer records, the stolen data itself can become the leverage.

---

Who Is at Risk?

The immediate risk is concentrated among customers who interacted with the affected services at:

• Manchester Airport
• London Stansted Airport
• East Midlands Airport

The most significant risks are likely to involve phishing, impersonation and social engineering rather than direct theft of payment information. Customers should be particularly cautious if they receive unexpected communications claiming to relate to:

• Airport bookings
• Parking
• Refunds
• Fast Track
• Lounge reservations
• Wi-Fi accounts
• Travel disruptions

A message containing accurate personal information should not automatically be considered legitimate. Attackers can use stolen information to make fraudulent messages look convincing.

---

Recommended by Security Experts

Customers affected by the incident should take several basic precautions.

• Be Suspicious of Unexpected Messages: Don't automatically trust emails or SMS messages mentioning airport services. Verify them independently.
• Don't Click Suspicious Links: If an email claims there is an issue with a booking, navigate directly to the airport's official website instead of clicking the provided link.
• Never Share Passwords or Banking Information: MAG has warned customers about communications requesting sensitive information. Treat unexpected requests for passwords, payment details or banking information as suspicious.
• Watch for Follow-Up Scams: A breach can create a secondary wave of attacks weeks or months later. The original incident may be over, but the stolen data can remain useful to criminals.

---

What Security Teams Should Learn From This

The incident offers several lessons for organisations operating critical infrastructure.

1. Treat Customer Systems as High-Value Assets: A Wi-Fi registration platform may not control an airport. But if it contains millions of customer records, compromising it can still create enormous damage.
2. Minimise Stored Data: Organisations should regularly review what customer information they actually need to retain. Less data stored means less data available to steal.
3. Segment Networks: Customer-facing infrastructure should be isolated from sensitive operational environments. A compromise of a booking or Wi-Fi system should not provide a pathway into critical airport infrastructure.
4. Monitor Large-Scale Data Access: Security teams should detect unusual activity such as: Bulk database queries, Large exports, Unusual administrative access, Privilege escalation, Abnormal authentication, and Unexpected outbound data transfers
5. Prepare for the Second Attack: The initial breach is only part of the problem. Once attackers obtain customer information, they can use it for phishing, impersonation and social engineering long after the original vulnerability has been closed. Incident response therefore needs to include customer protection and threat monitoring, not just system recovery.

---

The Bigger Picture: Critical Infrastructure Is More Than Operational Technology

The Manchester Airports Group incident demonstrates an important point about modern infrastructure security. When people think about an airport cyberattack, they usually imagine:

• Flight systems
• Radar
• Baggage systems
• Airport operations
• Security checkpoints

But an airport is also a massive digital business. It processes:

• Customer identities
• Booking information
• Vehicle data
• Contact information
• Wi-Fi registrations
• Payment transactions
• Loyalty information
• Third-party services

Every one of these systems expands the potential attack surface. The attacker doesn't necessarily have to compromise the system that controls the runway. They can target the system holding the people using the runway.

---

What We Know — And What We Don't

Confirmed

• Manchester, London Stansted and East Midlands airports were affected.
• All three airports are operated by Manchester Airports Group.
• Approximately 8.7 million customers are believed to be affected.
• Email addresses were accessed.
• Some customers had phone numbers, vehicle registrations and postcodes exposed.
• Data related to Wi-Fi registrations, parking, lounge and Fast Track services was accessed.
• Bank and payment details were not held on the affected system.
• Airport operations were not disrupted.
• Passenger safety and aviation security were not compromised. :contentReference[oaicite:4]{index=4}

Still Unknown

• Exactly how the attackers initially gained access.
• Which vulnerability, credential or system was exploited.
• The identity of the attackers.
• The precise number of customers whose additional information was accessed.
• The total amount of data extracted.
• Whether the stolen information has been published or sold.
• Whether additional systems will be identified during the investigation.

Those details will become increasingly important as the investigation continues.

---

Final Takeaway

The cyberattack affecting three UK airports is a reminder that a critical infrastructure attack doesn't need to shut down critical infrastructure to be serious.

No aircraft were grounded. Airport operations continued. Passenger safety was not compromised. But attackers still managed to access data belonging to approximately 8.7 million customers. And that's the bigger lesson. The weakest point in a critical infrastructure environment may not be the system controlling the operation.

It could be the Wi-Fi portal. The booking platform. The parking database. The customer-management system. The third-party integration. Attackers don't always attack the most important system. They attack the system that gives them the easiest path to something valuable. For the millions of customers affected, the next threat may not come from the original breach itself. It may arrive as an email, SMS or phone call that looks completely legitimate.

And that is exactly why this incident matters.