Manchester Airports Group breach — what it means for you

If you have used Manchester, Stansted or East Midlands airport, this is worth a couple of minutes. Please pass it on to anyone you think it might help.

What happened

Manchester Airports Group, which runs all three airports, confirmed on 27 August that an unauthorised third party had taken customer data. Around 8.7 million people are affected.

The data came from car park, lounge and Fast Track bookings, and in-airport Wi-Fi sign-ups. What was taken is:

• email addresses
• phone numbers
• vehicle registrations
• postcodes

No bank or payment details were involved. MAG has been clear that neither it nor the system that was accessed held them. Your existing bookings are still valid, and MAG is letting people change or cancel free of charge because of this.

A criminal group calling itself FulcrumSec has claimed responsibility, and has since published a large volume of the stolen data online.

Two things worth saying plainly

MAG is a victim here too. It is easy to pile on the organisation that got breached, and that reflex mostly helps the criminals. A company facing a competent attacker is in the same position as a household facing a determined burglar. MAG told its customers, told the regulator, and put the details out publicly — which is more than a lot of organisations manage.

MAG refused to pay, and that was the right call. They told The Register: “It has not paid the extortionists.” That is the correct decision even though it meant the data was published, and it is worth understanding why:

• Paying buys a promise from a criminal — nothing more. There is no delete button, no way to verify anything was destroyed, and copies routinely surface later regardless.
• Paying funds the next attack, on someone else, with better resources.
• It marks the payer as willing to pay, which invites a return visit.
• UK government guidance discourages ransom payments for exactly these reasons.

Refusing to pay is the harder choice and the right one. It deserves saying, because the alternative — quiet payments that never make the news — is how this whole industry keeps funding itself.

What you can do to keep yourself safe

Understand what the real risk is.The usual advice after a breach is “change your password”. That is not the risk here, because no passwords or bank details were taken. The risk is more convincing scams. Criminals now have your email, your phone number, your postcode and your car registration— so a fake parking charge, a fake “unpaid drop-off fee”, or a fake refund offer can quote genuine details about you. That is what makes it dangerous.

1. Be suspicious of anything about parking charges, fines, DVLA, car insurance renewals and claims, refunds or compensation — by email, text or phone. Especially if the details are right. Correct details are now evidence of nothing.
2. Never use the link or phone number in the message. Go to the website yourself, or ring the number on your own booking confirmation or your card. That single habit defeats most of this.
3. MAG will never contact you unexpectedly to ask for payment card details, banking information or passwords. Anyone doing so is not MAG.
4. Slow down when a message creates urgency.“Pay within 48 hours or a fine is issued” is the oldest lever there is. Real organisations do not mind you ringing them back.
5. Turn on two-factor authentication on your email account and your online banking. Your email is the master key to everything else you own — protect that first.
6. Keep an eye on your bank statements and credit score for the next few months, and query anything you do not recognise, however small.
7. Warn the people who won’t read this. Older relatives in particular. A convincing parking fine referencing a real car registration catches people who are not usually caught.

Three hard rules that need no judgement call

Parking, DVLA and insurance are the sharpest part of this, because all three come with a rule you can apply without having to weigh anything up:

• Parking charges. A genuine parking charge never arrives first by text or email. A real one is put on your windscreen, handed to you, or sent through the post. Councils say plainly that they will never text you about a penalty charge. So a parking fine that arrives by text or email is a scam — every time, no exceptions. This is the one to expect most, because your registration is exactly what they took.
• DVLA. They state it plainly: they never send emails or texts about vehicle tax refunds, and never ask for bank details by email. Refunds are issued automatically — there is no link to click, ever. So any text or email offering a tax refund, warning that a tax payment failed, or asking you to confirm licence details is fake, every time. No judgement needed. The only place for real DVLA business is gov.uk.
• Car insurance. A caller who has your registration and postcode can sound very convincing about a renewal quote or an accident claim you supposedly made. Your real insurer already knows your policy number — so ask them to tell youwhat it is. A genuine caller can. Never confirm details they offer you; make them produce something only your insurer would hold. And be wary of unsolicited “we understand you’ve been in an accident” calls — the registration being right proves nothing now.

Where to go — reliable places only

• MAG’s official update and FAQs — manchesterairport.co.uk/help/data-security-incident/
• Check if your email is in known breaches — haveibeenpwned.com, free, independent and well regarded
• Report a scam email — forward it to report@phishing.gov.uk
• Report a scam text — forward it to 7726, free on all UK networks
• Report fraud or a scam you have lost money to — actionfraud.police.uk or 0300 123 2040 (England, Wales, Northern Ireland). In Scotland, call Police Scotland on 101
• Complain about how your data was handled — ico.org.uk, the Information Commissioner’s Office

Type those addresses into your browser yourself rather than following a link — including from this page. That is the habit worth building.

Sources

• MAG statement on cyber security incident — Manchester Airports Group
• Data Security Incident — Update & FAQs — Manchester Airport
• Cybercrooks jet off with Manchester Airports Group customer data — The Register, 27 August 2026
• Manchester Airports Group says hackers stole travelers’ data — BleepingComputer, 27 August 2026
• FulcrumSec claims Manchester Airports hack, theft of 86 GB of data — BleepingComputer, 30 August 2026
• FulcrumSec Claims Responsibility for Manchester Airport Group Breach — Infosecurity Magazine, 2 September 2026
• Extortion Group Claims Manchester Airports Group Data Breach — SecurityWeek
• DVLA’s top tips for avoiding scams and DVLA warns customers to stay safe online — GOV.UK
• Alert to common SMS message scams relating to PCN payment — Traffic Penalty Tribunal
• Report a scam text message — National Cyber Security Centre
• Avoid and report internet scams and phishing — GOV.UK