Hackers Leak Data of 8.7m Manchester Airport Group Customers

Cyber criminals published personal data of nearly 8.7 million people after breaching Manchester, Stansted and East Midlands airports.

Criminal hackers have dumped the personal records of roughly 8.7 million people online after breaking into the systems of Manchester Airports Group (MAG), the operator of Manchester, London Stansted and East Midlands airports. The BBC reported the leak on 2 September 2026, following an intrusion the previous month.

The attackers had tried to extort MAG for an unspecified sum. When the company refused to pay, the gang made good on its threat and released the full haul. Customers of all three airports are now being told to brace for follow-on fraud, because the material is freely circulating among other criminals.

The stolen files came from databases tied to airport wi-fi sign-ups and car parking accounts. According to the breach analysis, the trove includes contact information, vehicle registration numbers and postcodes. The criminal group, which the BBC has chosen not to identify, is handing the entire collection to fellow scammers at no charge through its own website.

"Today we are releasing the Manchester Group database," the hackers wrote in their post, describing the cache as half a terabyte of pure personally identifiable information.

Specialists at the breach-tracking service HaveIBeenPwned examined the leaked files and verified their contents. They found email addresses, telephone numbers, home addresses, number plates, records of past purchases and data about the devices people used to browse.

MAG said it believes it has acted effectively to shield its customers. "MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, including reaching out to all those with upcoming bookings to advise them of additional support," the company said. It added that it is cooperating with the authorities and outside advisers, and stressed that travellers' physical safety inside the airports was never in danger.

Warning for wealthy and high-profile travellers

Cyber-security researcher Kevin Beaumont urged anyone caught up in the leak to stay watchful for further scams and intrusions, singling out well-known and affluent individuals as being at particular risk. He noted that the records reveal not only where people have been but where they plan to go.

"The data includes both historical locations and planned future travel, so individuals sensitive to their movements being known may need to take precautions," Beaumont said. He warned that fraudsters could recycle details such as phone numbers and car registrations to make their approaches appear convincing.

One feature of this leak sets it apart from most. The site hosting the MAG files sits on the ordinary internet rather than the dark web, where such "leak sites" usually operate. That openness makes the data simpler to reach, raising the danger for MAG's customers and for the other firms the same crew has hit in recent months.

Alongside dumping the files, the gang bragged about its technique. It said it had broken into each victim the same way, taking advantage of flaws in how organisations safeguard the digital keys that secure their internal networks.

Advice for those affected

UK law enforcement, including the National Crime Agency, has consistently told targets of extortion to refuse ransom demands, arguing that payments only sustain the criminal economy behind such attacks.

The Information Commissioner's Office publishes guidance for people whose information has been exposed. It advises reporting stolen documents such as passports, credit cards or driving licences to whoever issued them, and checking bank statements and credit reports for anything out of the ordinary. It also recommends staying wary of unexpected emails, texts and calls, and protecting online accounts with strong passwords and multi-factor authentication.

Manchester Airports Group, airport data breach, MAG hack, Stansted airport, East Midlands airport, cyber attack UK, personal data leak, ransom extortion