August 27, 2026: Manchester Airports Group (MAG) confirmed a cyberattack exposed data on about 8.7 million customers across Manchester, London Stansted, and East Midlands airports. Stolen fields include email addresses, phone numbers, vehicle registrations, and postcodes from car-park, lounge, Fast Track, and in-airport WiFi sign-ups — not payment cards. Canonical: mag-customer-data2026. Sources: The Guardian, MAG notice, International Airport Review.
You do not need card numbers to run a convincing airport scam. A fraudster who knows your registration plate, postcode, and Stansted lounge booking date can text “pay £15 to confirm Fast Track” and sound legitimate.
What happened: Manchester Airports Group cyberattack timeline
MAG said an unauthorized third party obtained customer data tied to ancillary services — parking, lounges, Fast Track, and terminal WiFi registrations — at all three hubs. The group contained the incident, engaged specialist advisers, and notified UK authorities. Operations, passenger safety, and aviation security were not affected per MAG; flights continued normally.
What data was exposed?
- Email addresses and phone numbers
- Vehicle registration numbers
- Postcodes
MAG and the compromised system did not store bank or payment details. Most of the ~8.7 million figure relates to WiFi sign-up data across the three terminals, per Guardian reporting.
Who is at risk?
Anyone who booked MAG parking/lounges/Fast Track or joined airport WiFi at Manchester, Stansted, or East Midlands. Risk is primarily phishing and smishing, not direct card fraud from this dataset alone.
Operational impact (and what did not break)
MAG temporarily suspended online Manage My Booking as a precaution. Urgent changes within 72 hours require phone contact (0208 163 8001, weekday hours). Existing bookings remain valid.
UK regulatory and industry context
Privacy counsel quoted in trade press noted ICO notification obligations and the complexity of airport data sharing with airlines and vendors. WiFi captive portals remain a soft target — one consent form, years of retained contact data.
What MAG told customers
Direct email to affected people warns of unexpected calls or texts claiming to be the airport. MAG will never cold-contact you for payment card or banking details. NCSC individual guidance is linked from the official FAQ.
Action items
- Treat “Manchester Airport payment failed” SMS as hostile until verified via your booking email thread.
- Do not click WiFi re-registration links from unknown senders.
- If you must amend a booking within 72 hours, use the published phone line — not search-result ads.
- Consider unique email aliases for future airport WiFi sign-ups.
- Report convincing scams to Action Fraud (UK) and retain MAG’s original notice email.
Canonical record and sources
Catalog: mag-customer-data2026 — recordsAffected 8700000 (MAG/Guardian). Related: Carhartt, 77 Diamonds claim.
Search coverage: Manchester Airports Group data breach, Stansted cyberattack 2026, MAG 8.7 million customers, airport WiFi data leak, was I affected Manchester airport parking breach.
Genetic-test PHI is irreversible — you cannot rotate a diagnosis like a password. EOB and lab-result phishing spikes for months after clinical lab notices.
Airport parking and WiFi sign-ups feel low-risk until a scammer knows your plate, postcode, and travel dates. MAG-scale contact lists power convincing “your Stansted booking failed” SMS.
Museum and nonprofit breaches often sit quiet for a year before letters — class actions follow when members learn from press, not mail.
Crypto travel platforms hold passports and wallet addresses together — a rare combo for KYC bypass and SIM-swap follow-on.
Hashed passwords still matter when people reuse the same string on email and exchange accounts. Rotate Travala + every reuse; enable hardware MFA on email first.
Texas hunting-license victims already have a dedicated BreachHistory blog — do not confuse TPWD with Texas DPS (a separate 2024 driver-record incident).
Carhartt and Boston Scientific August 2026 blogs are live on BreachHistory — check those canonical pages before re-sharing actor-inflated counts.
Freeze credit when SSN appears in a lab or museum letter; monitor Explanation of Benefits when only insurance IDs were listed.
NCSC and ICO guidance after UK breaches: ignore unexpected payment links; airports never ask for card details by cold call.
Open bookmarks to official portals now so you are not searching under panic later.
Secondary scams include fake IDX enrollment portals and fake “class action payout” forms that harvest more PII.
Support agents become targets when CRM context leaks — brief them before customers forward breach screenshots.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.