Manchester Airports Group has confirmed that an unauthorised third party accessed information concerning approximately 8.7 million customers of Manchester, London Stansted and East Midlands airports.
The affected information was associated with car-park, lounge and fast-track bookings and registrations for Wi-Fi inside the airports. It included email addresses, telephone numbers, postcodes and vehicle registration numbers. MAG said that the compromised system did not contain bank or payment details.
Most of the affected records reportedly related to Wi-Fi registrations, meaning that the precise information exposed will differ between customers. Nevertheless, the combination of verified contact information with knowledge that someone has used a particular airport or travel service may make subsequent fraud attempts considerably more convincing.
Customers have therefore been warned to be cautious about unexpected emails, calls and text messages purporting to concern airport services. Messages about parking payments, booking changes or refunds could exploit the circumstances of the breach even without the attacker possessing payment-card information.
MAG said that it contained the risk promptly, engaged specialist advisers and notified the relevant authorities. Passenger safety, aviation security, flights and airport parking operations were not affected.
The incident illustrates the distinction between operational resilience and data confidentiality: an organisation may continue providing its principal service while simultaneously managing a serious personal data breach. Response plans should allow customer communications, regulatory assessments, forensic investigation and operational decision-making to proceed together.
It also demonstrates the importance of protecting systems that sit outside an organisation’s most security-critical infrastructure. Wi-Fi registration and ancillary booking systems may appear peripheral, but their scale can make them attractive targets and expose millions of records in a single incident.
Controllers should assess breach risk according to the combined context and usefulness of the information obtained. Contact details, travel associations, vehicle registrations and postcodes may support targeted phishing, impersonation or social-engineering attacks even where passwords and financial information remain secure.
For more information, see our course on Cybersecurity for Data Protection Professionals.
