Manchester Airports Group confirmed a data security incident after the extortion group calling itself FulcrumSec published data tied to what Have I Been Pwned’s analysis puts at roughly 8.8 million people, following MAG’s refusal to pay a ransom demand.
MAG operates Manchester, London Stansted, and East Midlands airports and says the exposed data covers car park, lounge, and Fast Track bookings, plus airport WiFi sign-ups, including email addresses, phone numbers, vehicle registrations, and postcodes. MAG states plainly on its incident page that “neither MAG nor the system accessed hold customers’ bank or payment details” and that “at no point has passenger safety or aviation security been compromised.” FulcrumSec has claimed the initial access came from administrator keys for a customer engagement platform left exposed in the frontend JavaScript of all three airport websites.
The original insight is the gap between MAG’s technical containment and what a claimed root-cause account describes. MAG’s own disclosure focuses on what customers should do next; it does not confirm or deny the specific access method the extortion group has publicized. That gap matters for other operators of high-traffic customer-facing sites: a hardcoded key in client-side JavaScript is trivially discoverable by anyone who views page source, and the fix, moving key management server-side, has been standard advice for years. Security leaders running any customer portal, booking system, or loyalty platform should treat this as a prompt to audit their own frontend code for exposed API keys today, not after their own extortion notice arrives.
Source: Manchester Airports Group. Related: Nutex Health Now Faces an Extortion Threat Too and A Single Vendor Breach Just Hit a Dozen State Courts.
