The Manchester Airports Group (MAG) disclosed that hackers breached its systems and stole customer data, including Wi-Fi sign-ups from Manchester, Stansted, and East Midlands airports.
The intruder did not access customer payment details, and the attack had no impact on airport operations, the company said.
A statement from the company today notes that the exfiltrated data also “relates to car park, lounge and Fast Track bookings.” The list of compromised details includes customers’ email addresses, phone numbers, vehicle registration numbers, and postcodes.
“The incident has not resulted in any operational disruption,” assured the organization, adding that “Airport operations remain unaffected and customer parking services continue to operate normally.”
Out of an abundance of caution, MAG has temporarily suspended its online “Manage My Booking” service and is instead directing travelers to use its phone line.
MAG is the UK’s largest airport operator, and owner of Manchester, London Stansted and East Midlands airports, which together handle over 66 million passengers yearly.
The company employs 40,000 people and generates annual revenue of £1.5 billion.
After discovering the intrusion, MAG says that it moved quickly to contain it, restricting access to the affected systems, engaging with external experts, and notifying law enforcement.
Potentially exposed customers are advised to remain alert for suspicious communications and avoid clicking on links arriving via email or SMS.
MAG stresses that it will never ask customers for payment card information, banking details, or passwords. Customers should reject and report to the authorities any attempts to obtain personal, financial, or other sensitive information.
People are also encouraged to follow NCSC’s post-breach recommendations to stay safe.
The company says it has contacted impacted customers directly, but did not disclose the number of affected individuals.
Local media reported that data of up to 8.9 million travelers may have been exposed, citing private MAG statements; however, BleepingComputer has not been able to confirm the figure.
At the time of writing, no ransomware or data extortion groups have claimed the attack publicly.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
