FulcrumSec leaks Manchester Airports Group data after negotiations fail

The notorious hacking group FulcrumSec has published a stolen dataset taken from Manchester Airports Group after the organisation failed to meet its ransom demands.

 

On August 27, MAG disclosed that threat actors had breached its internal network in a data security incident, prompting the company to launch an investigation alongside external cyber security experts to determine the scope and impact of the breach.

 

MAG’s investigation confirmed that a quantity of customer data relating to car park, lounge and Fast Track bookings, as well as in-airport Wi-Fi sign-ups, was obtained at Manchester, Stansted and East Midlands airports.

 

The organisation assured that passenger safety, aviation security, and overall airport operations—including customer parking facilities—remained entirely unaffected by the incident. Although the exact number was not initially disclosed, a company spokesperson later confirmed that up to 8.7 million customers may have been impacted, with that figure potentially rising as the investigation continues.

 

The FulcrumSec hacker group has claimed responsibility for the cyber attack on MAG, and said it has stolen approximately 86 GB of confidential data from the company. the hacker group claimed that it gained access using Manchester Airport-specific Iterable API credentials exposed in client-side JavaScript. 

 

FulcrumSec added that the compromised dataset includes nearly 200,000 upcoming travel records for the remainder of 2026, containing travel dates, times, booking details, and associated personally identifiable information. 

 

 

The perpetrators have now published the entire stolen dataset of 550 GB of confidential data indicating that ransom negotiations with MAG have failed.

 

Data breach repository Have I Been Pwned confirmed that the incident exposed 8.8 million “customers of Manchester, Stansted and East Midlands airports”. The leaked data included personal information relating to airport services, including vehicle registrations and parking history, Fast Track purchases, lounge bookings and more.

 

The UK Information Commissioner’s Office (ICO) said that MAG had formally notified the regulator about the incident. The ICO said it was currently assessing the situation and would consider the circumstances surrounding the data security incident, including the nature and extent of the information involved, before determining whether any further action was necessary.