2026 Manchester Airports Group — ~8.8M emails/phones (HIBP); parking/lounge/WiFi + FulcrumSec leak

Verified airport-group notice with FulcrumSec extortion overlay — August 27–30, 2026. Manchester Airports Group (MAG) confirmed an unauthorized third party obtained customer data from car park, lounge, Fast Track, and in-airport WiFi systems for Manchester, London Stansted, and East Midlands airports (~8.7 million customers per MAG/Guardian). Fields disclosed by MAG include emails, phones, vehicle registrations, and postcodes; no bank/payment data per company. On August 30 BleepingComputer reported FulcrumSec claimed ~86 GB stolen and shared samples BC validated against a traveller’s purchase history, including Fast Track bookings, terminals, amounts, and marketing classifications — suggesting more granular booking/travel detail than MAG’s initial summary. FulcrumSec alleged Iterable API credentials exposed in client-side JavaScript and ~200,000 upcoming-travel records for the remainder of 2026 (unverified actor count/scope). MAG passenger safety and flight operations were unaffected. recordsAffected 8700000 from MAG; companyConfirmed true for intrusion; FulcrumSec 86 GB / 200k upcoming-travel claims unverified. Update September 2026: after MAG declined ransom demands, FulcrumSec published a large dump; Have I Been Pwned parsed approximately 8.8 million email addresses and phone numbers (SecurityWeek). recordsAffected updated to 8800000 from HIBP/SecurityWeek. Update: Have I Been Pwned ingested the FulcrumSec-published corpus (~8.8M emails/phones with names, plates, purchases, geo/IP); passengers can check HIBP.