Stolen data of 8.7m airport customers published online after ransom refused

According to BBC Cyber Correspondent Joe Tidy, hackers have published the personal data of nearly nine million people online after a major cyber breach affecting three major UK transport hubs.

The leak follows a targeted extortion attempt against Manchester Airports Group (MAG) – which operates Manchester, London Stansted, and East Midlands airports – after the company refused to pay an undisclosed ransom demanded by the cyber-crime group.

The compromised database, spanning roughly half a terabyte of personally identifiable information, includes customer email addresses, phone numbers, postal addresses, vehicle registration numbers, and detailed travel and browsing device history stemming from car park, lounge, Fast Track, and in-airport Wi-Fi bookings.

Unusually, the hackers published the entire dataset for free on the regular internet rather than a dark-web leak site, significantly increasing accessibility and risks for victims.

Cybersecurity experts have warned affected individuals to be on high alert for secondary phishing campaigns, scams, and targeted attacks. Because the exposed material includes historical logs and planned future travel details, passengers, particularly high-profile or wealthy individuals, are being urged to take extra precautions regarding their physical movements.

Data leak analysis from Have I Been Pwned confirmed the nature of the exposed files. While MAG has maintained that the affected internal systems did not store bank or payment details, and that passenger safety and airport operations remain entirely unaffected, law enforcement agencies and regulators continue to advise victims to monitor credit reports closely and watch out for unsolicited communications.

BBC