- 8.7 Million Users Affected: The breach impacts travelers who used Wi-Fi or booking services across Manchester, London Stansted, and East Midlands airports.
- Technical Vector Identified: The leak originated from airport-specific Iterable API credentials accidentally exposed in client-side JavaScript on official websites.
FulcrumSec Claims Massive Data Exfiltration at Manchester Airports Group
The extortion group FulcrumSec is taking credit for a major security failure at the Manchester Airports Group (MAG). Our team looked into their claims, and it looks like about 86 gigabytes of internal files were snatched. This mess hits three big UK travel hubs: Manchester Airport, London Stansted, and East Midlands Airport. While planes are still flying and gates are open, the fact that millions of passengers just had their private details aired out is a massive problem.
This isn’t just a group making empty threats. We’ve seen independent checks that confirm the data is the real deal, matching up specific traveler records—like when they booked and exactly what they paid—with actual history. It shows the attackers didn’t have to work too hard to bypass security and get into the backend systems. We are looking at roughly 8.7 million customers who now have to worry about their data being in the wrong hands.
Anatomy of the Leak: How API Keys Led to Exposure
Researchers digging into the wreckage found a pretty embarrassing mistake on the airport websites. The whole thing started because API credentials for a tool called Iterable were just sitting there in the public JavaScript code for anyone to see. Leaving these keys out in the open is like leaving the master key to the building under the front mat. It’s a classic blunder often tracked as CWE-798: Use of Hard-coded Credentials.
The data itself is uncomfortably specific. It’s not just names and emails; they got hold of phone numbers, license plate numbers for parking, and home postcodes. Even worse, they have the full history of when people used airport lounges or paid for Fast Track security. That kind of info is perfect for scammers who want to craft very convincing fake emails to trick people later on.
Operational Stability and Financial Safety
If there’s any silver lining, it’s that the Manchester Airports Group says they don’t keep credit card or bank info on the specific system that got hit. So, for now, you probably don’t need to cancel your cards over this. The breach also didn’t touch the actual flight systems. Air traffic control and runway security stayed locked down, and flights are moving as scheduled.
Even so, this mess shows why you can’t cut corners with API security. Companies often forget about these third-party connections, but they end up being the easiest way in for hackers. As everything moves to web-based services, sticking to the OWASP API Security standards is the only way to stay ahead of these groups.
Data Breach Summary
| Data Category | Details of Exposure | Risk Level |
|---|---|---|
| Customer Count | Approximately 8.7 million records | High |
| Personal Identifiers | Names, Emails, Phone Numbers, Postcodes | High |
| Travel Logistics | Vehicle License Plates, Booking History, Lounge Access | Moderate |
| Financial Data | No banking or card details stored on affected system | None Reported |
| Operational Impact | Flight schedules and airport security unaffected | None Reported |
The big question now is how MAG plans to fix this with the millions of people affected. Flights might be on time, but the trust people have in these airports has taken a serious hit. This is one of the biggest leaks to hit UK transport in a long time, and it’s a loud wake-up call about how one small coding mistake can put a whole country’s travel privacy at risk.
