Loading story…
Manchester Airports Group (MAG), which operates Manchester, London Stansted, and East Midlands airports, disclosed a breach affecting approximately 8.7 million customers. The exposed data primarily came from airport Wi-Fi registrations and parking, lounge, and Fast Track booking services; MAG temporarily suspended its online Manage My Booking service. The company said passenger safety, aviation security, and flight operations were not affected.
The FulcrumSec data-extortion group claimed it exfiltrated roughly 86 GB of data using airport-specific Iterable API credentials exposed in client-side JavaScript. Stolen contact, travel, and vehicle-related data could support targeted phishing and smishing campaigns, identity fraud, extortion, and potential intelligence collection against travelers.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
FulcrumSec claimed it stole approximately 86 GB of MAG data by exploiting airport-specific Iterable API credentials exposed in client-side JavaScript. The group said the material included contact, postcode, vehicle-registration, and travel data, including nearly 200,000 records for travel scheduled during the rest of 2026.
Manchester Airports Group disclosed a data breach reportedly affecting about 8.7 million customers, primarily involving email addresses from airport Wi-Fi registrations as well as parking, lounge, and Fast Track booking data. MAG temporarily suspended its Manage My Booking service and said passenger safety, aviation security, and flight operations were unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceblog.bushidotoken.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Manchester Airports Group (MAG) disclosed that customer data linked to Manchester, Stansted and East Midlands airports was accessed and later published by the FulcrumSec extortion group after reported ransom negotiations failed. The incident affects roughly **8.7–8.8 million** people using parking, lounge, Fast Track and airport Wi-Fi services; exposed records reportedly include contact details, vehicle-registration and postcode information, booking history, and some upcoming 2026 travel records. MAG said airport operations, aviation security and passenger safety were not affected, and the UK ICO is assessing its breach notification. FulcrumSec said it obtained MAG’s Iterable server-side API credentials from publicly accessible Next.js JavaScript bundles, not through a conventional network intrusion. The credentials were reportedly exposed from mid-2022 until August 2026 and could enable bulk customer-data exports as well as potentially destructive user-management API actions; independent researcher Scott Helme said he verified the technical basis of the claim. Organizations should ensure server-side API keys are never embedded in client-delivered code, rotate exposed credentials, review third-party SaaS audit logs, and assess data-access and account-management activity for affected integrations.
Sep 10, 2026
Manchester Airports Group (MAG), which operates Manchester, London Stansted, and East Midlands airports, disclosed that an unauthorized third party obtained customer data from services including car parking, lounges, Fast Track, and airport Wi-Fi. The compromised data includes email addresses, telephone numbers, vehicle registration numbers, and postcodes; reporting indicates up to 8.7 million people may be affected, though most records reportedly contained email addresses only. MAG said payment-card and bank details were not held in the affected system. MAG contained the incident, restricted access to affected systems, engaged external cybersecurity specialists, notified relevant authorities, and temporarily suspended the online **Manage My Booking** service. It reported no impact on airport operations, aviation security, passenger safety, or existing bookings, and advised affected customers to remain alert for phishing emails, smishing messages, and fraudulent calls using the stolen contact and travel-related information.
Sep 3, 2026
FulcrumSec has claimed responsibility for breaching UK engineering firm Arup Group and stealing large volumes of data, later listing the company on its Tor leak site. According to the threat actor’s account, the intrusion began in September 2025 after attackers found a GitHub personal access token hardcoded in a JavaScript file on a forgotten Arup subdomain, which allegedly opened access to more than 10,000 private repositories and led to additional credentials in code. The group said it exfiltrated about **700GB of GitHub repositories**, **2TB of Azure and AWS S3 data**, database backups, source code, and other internal material before credentials were rotated. The stolen data allegedly included sensitive information tied to major clients and infrastructure projects, including HS2-related repositories, Euston Station design files, archaeological GPS coordinates, Neuron BMS and Odoo ERP data, Apple code-signing certificates with plaintext passwords, and GCP payment gateway credentials. FulcrumSec said Arup detected parts of the intrusion roughly six weeks after initial access but that the attackers retained visibility into the environment for months, analyzing the haul before contacting the company in April 2026. The incident underscores the downstream risk posed by hardcoded secrets, forgotten internet-facing assets, delayed credential rotation, and weak monitoring of source-code and cloud environments.
Jun 29, 2026