The breach involved customer information associated with car park, airport lounge and Fast Track bookings, as well as registrations for Wi-Fi services inside the three airports. Data accessed by an unauthorised third party included email addresses, telephone numbers, vehicle registration numbers and postcodes.
Bank account and payment card information was not compromised because neither Manchester Airports Group nor the affected system stored those details. The company has said that, for the vast majority of affected customers, the information obtained was limited to an email address.
Manchester Airports Group, commonly known as MAG, said it became aware of the incident this week and immediately restricted access to the affected systems. Cybersecurity specialists were brought in to investigate the intrusion and strengthen safeguards while the company notified the National Cyber Security Centre and the Information Commissioner’s Office.
The group has contacted affected customers directly and warned them to be alert to fraudulent emails, text messages and telephone calls that could exploit information stolen during the breach. Customers have been advised not to follow unexpected links, open suspicious attachments or provide banking information, payment card details or passwords in response to unsolicited communications.
All existing airport bookings remain valid and passengers have been told they can continue with travel plans as normal. Parking operations are continuing without disruption, while airport systems responsible for passenger processing, safety and aviation security were not compromised.
MAG has, however, temporarily disabled its online Manage My Booking facility as a precaution. Customers needing to amend or cancel a booking falling within a 72-hour period have been directed to customer services, with the operator warning that telephone waiting times could be longer than usual.
The intrusion is among the larger customer-data breaches disclosed by a UK transport operator, underscoring the growing exposure created by digital services that sit alongside airports’ core aviation infrastructure. Modern airports process large volumes of passenger information through parking systems, premium security products, retail services, mobile applications and public Wi-Fi networks.
Although the information stolen did not include payment data, cybersecurity specialists have warned that combinations of email addresses, telephone numbers, postcodes and vehicle registrations can help criminals construct convincing phishing attacks. A fraudulent message referring to an airport booking, parking reservation or travel service may appear more credible when it contains information already associated with the customer.
The identity of the attackers and the precise method used to gain access have not been publicly established. MAG has also not disclosed the full period during which the compromised data was stored or accessed. The attackers are believed to have entered the customer-facing system several days before the breach was identified.
Manchester Airports Group is the UK’s largest airport operator and handles more than 60 million passengers annually across Manchester, Stansted and East Midlands. The three airports connect passengers with hundreds of destinations and form significant parts of Britain’s transport infrastructure.
The attack comes amid mounting pressure on companies responsible for transport, retail and other large-scale services to strengthen cyber defences. Airports are particularly complex environments because operational technology, airline systems, passenger information, commercial services and third-party platforms can operate within interconnected digital ecosystems.
UK cybersecurity authorities have repeatedly urged organisations operating essential services to limit unnecessary internet exposure, maintain effective vulnerability-management programmes and separate critical systems from less sensitive networks. Network segmentation can restrict an intruder who compromises a customer-facing service from moving into operational systems.
The breach also highlights the regulatory consequences facing organisations that process personal information. Under UK data-protection rules, companies are expected to use technical and organisational safeguards proportionate to the sensitivity and volume of information held. Serious breaches that pose risks to individuals must be reported to the data regulator within prescribed time limits.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
