Loading story…
Manchester Airports Group (MAG) disclosed that customer data linked to Manchester, Stansted and East Midlands airports was accessed and later published by the FulcrumSec extortion group after reported ransom negotiations failed. The incident affects roughly 8.7–8.8 million people using parking, lounge, Fast Track and airport Wi-Fi services; exposed records reportedly include contact details, vehicle-registration and postcode information, booking history, and some upcoming 2026 travel records. MAG said airport operations, aviation security and passenger safety were not affected, and the UK ICO is assessing its breach notification.
FulcrumSec said it obtained MAG’s Iterable server-side API credentials from publicly accessible Next.js JavaScript bundles, not through a conventional network intrusion. The credentials were reportedly exposed from mid-2022 until August 2026 and could enable bulk customer-data exports as well as potentially destructive user-management API actions; independent researcher Scott Helme said he verified the technical basis of the claim. Organizations should ensure server-side API keys are never embedded in client-delivered code, rotate exposed credentials, review third-party SaaS audit logs, and assess data-access and account-management activity for affected integrations.
See attribution, scope, and your downstream exposure.
10 events from the most recent confirmed update back to the earliest known activity.
Scott Helme published a technical analysis reporting that he verified FulcrumSec's central claim that publicly exposed Iterable server-side API keys enabled access to MAG customer data. The keys reportedly permitted broad API access, including user-profile retrieval and database exports.
MAG announced a breach of its internal network affecting data associated with Manchester, Stansted, and East Midlands airports. It said the compromised data related to parking, lounges, Fast Track, and in-airport Wi-Fi services, while airport operations, aviation security, passenger safety, and parking facilities were unaffected.
The Stansted Airport Iterable key was reportedly publicly exposed through 23 August 2026.
The Manchester Airport Iterable key was reportedly publicly exposed through 22 August 2026.
The East Midlands Airport Iterable key was reportedly publicly exposed through 16 August 2026. Wayback Machine history was used to establish the approximate exposure period.
A Manchester Airport-specific Iterable server-side API key was reportedly exposed in a publicly accessible Next.js JavaScript bundle beginning on 11 July 2022.
A separate Iterable server-side API key in Stansted Airport's public JavaScript bundle was reportedly exposed beginning on 28 June 2022.
An Iterable server-side API key in East Midlands Airport's public Next.js JavaScript bundle was reportedly exposed beginning on 23 June 2022.
MAG formally notified the UK Information Commissioner's Office of the incident. The ICO said it was assessing the nature and extent of the exposed information to determine whether further action was needed.
FulcrumSec claimed responsibility for the incident and published what it described as MAG's full stolen dataset after ransom negotiations allegedly failed. The group alleged it had obtained data through the exposed Manchester Airport Iterable credentials, including future-travel records and personally identifiable information.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceteiss.co.uk
Open sourcescotthelme.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Manchester Airports Group (MAG), which operates Manchester, London Stansted, and East Midlands airports, disclosed that an unauthorized third party obtained customer data from services including car parking, lounges, Fast Track, and airport Wi-Fi. The compromised data includes email addresses, telephone numbers, vehicle registration numbers, and postcodes; reporting indicates up to 8.7 million people may be affected, though most records reportedly contained email addresses only. MAG said payment-card and bank details were not held in the affected system. MAG contained the incident, restricted access to affected systems, engaged external cybersecurity specialists, notified relevant authorities, and temporarily suspended the online **Manage My Booking** service. It reported no impact on airport operations, aviation security, passenger safety, or existing bookings, and advised affected customers to remain alert for phishing emails, smishing messages, and fraudulent calls using the stolen contact and travel-related information.
Sep 3, 2026
Researchers from Stanford University, the University of California, Davis, and TU Delft found **1,748 valid API credentials** exposed across roughly **10,000 public webpages** after analyzing about **10 million websites**, revealing a broad secret-leakage problem outside traditional code repositories. The credentials, identified with TruffleHog and detailed in the study *Keys on Doormats: Exposed API Credentials on the Web*, provided access to services including **AWS**, **GitHub**, **Stripe**, and **OpenAI**. The exposed secrets were tied to multinational corporations, critical infrastructure operators, government agencies, and at least one global bank. Most of the exposed credentials were embedded in **JavaScript** resources, often inside bundled files generated by tools such as Webpack, creating direct paths into cloud infrastructure, payment systems, and software repositories. Researchers said AWS keys made up more than **16%** of verified exposures, and cited cases including cloud credentials linked to a global bank’s core infrastructure and firmware repository credentials associated with drones and remote-controlled devices, raising the risk of malicious firmware updates. After responsible disclosure, the number of exposed credentials dropped by about half within two weeks, but the study found such secrets often remain publicly accessible for an average of **12 months** and sometimes for years.
Jun 29, 2026
FulcrumSec has claimed responsibility for breaching UK engineering firm Arup Group and stealing large volumes of data, later listing the company on its Tor leak site. According to the threat actor’s account, the intrusion began in September 2025 after attackers found a GitHub personal access token hardcoded in a JavaScript file on a forgotten Arup subdomain, which allegedly opened access to more than 10,000 private repositories and led to additional credentials in code. The group said it exfiltrated about **700GB of GitHub repositories**, **2TB of Azure and AWS S3 data**, database backups, source code, and other internal material before credentials were rotated. The stolen data allegedly included sensitive information tied to major clients and infrastructure projects, including HS2-related repositories, Euston Station design files, archaeological GPS coordinates, Neuron BMS and Odoo ERP data, Apple code-signing certificates with plaintext passwords, and GCP payment gateway credentials. FulcrumSec said Arup detected parts of the intrusion roughly six weeks after initial access but that the attackers retained visibility into the environment for months, analyzing the haul before contacting the company in April 2026. The incident underscores the downstream risk posed by hardcoded secrets, forgotten internet-facing assets, delayed credential rotation, and weak monitoring of source-code and cloud environments.
Jun 29, 2026