How did the Manchester Airports Group cyberattack take place, and what data was exposed in the 8.7 million customer records? The experts weigh in

As the UK enters one of its busiest periods for travel, some holiday makers will be questioning how hackers managed to get their hands on their personal data.

<![CDATA[ <article> <p>As the UK enters one of its busiest periods for travel, some holiday makers will be questioning how hackers managed to get their hands on their personal data.</p><p>The Manchester Airports Group (MAG), which owns and oversees Manchester, London Stansted, and East Midlands airports, has revealed that hackers managed to steal data belonging to 8.7 million customers.</p><p>Given the sources of the data taken - spanning car park services, lounge and Fast Track bookings and in-airport WIFI sign-ups - it is likely a large database of information was accessed by the hackers.</p><h2 id="what-data-was-taken">What data was taken?</h2><p>The data accessed and stolen by the hackers include email addresses, phone numbers, vehicle registrations and postcodes of up to 8.7 million customers.</p><p>While banking and financial information remained secure during the attack, this level of data exposure places customers at a heightened risk for targeted phishing and scams.</p><div class="fancy-box"><div class="fancy_box-title"></div><div class="fancy_box_body"><figure class="van-image-figure " ><div class='image-full-width-wrapper'><div class='image-widthsetter' ><p class="vanilla-image-block" style="padding-top:56.25%;"><img id="iGCEJhusMZf623FQovppd9" name="TR.0093_perspectives assets_logo" caption="" alt="TechRadar Pro Perspectives logo in purple" src="https://cdn.mos.cms.futurecdn.net/iGCEJhusMZf623FQovppd9.png" mos="" link="" align="" fullscreen="" width="" height="" attribution="" endorsement="" class="pinterest-pin-exclude"></p></div></div><figcaption itemprop="caption description" class=""><span class="credit" itemprop="copyrightHolder">(Image credit: Future)</span></figcaption></figure><p class="fancy-box__body-text">Got an opinion for us? <a data-analytics-id="inline-link" href="https://www.techradar.com/pro/perspectives-how-to-submit" target="_blank">Here’s how you can submit your perspective</a></p></div></div><p>A <a href="https://www.manchesterairport.co.uk/help/data-security-incident/" target="_blank" rel="nofollow">statement</a> by MAG said, “We immediately contained the risk and have been working with specialist advisors and taking appropriate steps to protect our customers and systems. We have informed and are working with the relevant authorities. At no point has passenger safety or aviation security been compromised.”</p><p>MAG advised customers who have been affected by the breach to remain vigilant against suspicious emails and calls. Given the data exposed in the attack, these could be highly specific, referring to flights, parking (including customer number plates), and airport services.</p><p>MAG issued the following guidance:</p><ul><li>Remaining vigilant for suspicious emails, text messages or phone calls</li><li>Avoiding clicking on links or opening attachments from unexpected communications</li><li>Seeking further support and advice at <a href="https://www.ncsc.gov.uk/guidance/data-breaches#section_3">Data breach guidance for individuals</a></li></ul><h3 class="article-body__section" id="section-expert-perspectives-on-mag-data-breach"><span>Expert perspectives on MAG data breach</span></h3><ul><li><strong>Graeme Stewart, Head of Public Sector, Check Point Software</strong></li></ul><p><em>We warned after the attacks on the automotive sector last year that aviation needed to move onto a war footing. This feels like the moment that warning becomes very real.</em></p><p><em>Cyber criminals have already shown us what sustained pressure on a major industry can look like. They find the weak points, work through suppliers and connected systems, steal data and keep coming. There was every reason to believe aviation would become an attractive target, and an incident affecting almost nine million airport customers should concentrate minds across the sector.</em></p><div><blockquote><p>The absence of cancelled flights or queues at terminals does not make this a small cyber attack. The data reportedly taken can now be weaponised.</p></blockquote></div><p><em>The absence of cancelled flights or queues at terminals does not make this a small cyber attack. The data reportedly taken can now be weaponised. Criminals know these people have a relationship with Manchester, Stansted or East Midlands airports and potentially have phone numbers, postcodes and vehicle registrations to make their approach believable. A fake parking refund, Fast Track problem or message about this very breach suddenly becomes much harder for an ordinary customer to spot.</em></p><p><em>If you believe you are affected, be extremely suspicious of any unexpected contact about the airports or this incident. Do not follow links in emails or texts asking you to confirm information, make a payment or claim a refund. Go directly to the airport’s official website if you need to check something. If somebody calls claiming to be from the airport, hang up and contact the organisation independently.</em></p><p><em>Anyone who has already handed over banking information following suspicious contact should speak to their bank immediately. If you have given away a password, change it anywhere you have reused it and switch on two-step verification.</em></p><p><em>For the aviation industry, there should be no comfort taken from the fact the terminals are operating normally today. Last year was a warning about what happens when attackers focus their attention on a sector. Aviation needs to behave as though a sustained campaign has begun, because waiting for an attack that stops planes moving before treating this as serious would be a dangerous mistake.</em></p><ul><li><strong>Dr. Ilia Kolochenko, Founder, ImmuniWeb:</strong></li></ul><p><em>The risk of this data breach seems to be significantly underestimated or downplayed for almost 9 million victims. The majority of lounge and fast-track line bookings are wealthy passengers, whose travel data may per se constitute sensitive, embarrassing or even incriminating information, therefore being a valuable commodity for unscrupulous cybercriminals.</em></p><div><blockquote><p>A wave of personalized and AI-enhanced blackmailing and extortion campaigns may be launched shortly.</p></blockquote></div><p><em>A wave of personalized and AI-enhanced blackmailing and extortion campaigns may be launched shortly. Moreover, some specialized cyber gangs will likely offer the data to investigative journalists – without fully disclosing the illicit origin of the data – to track celebrities or trace sanction evasion, causing even more damage to the victims.</em></p><p><em>In case of extortion, many victims will unlikely contact the police and will rather silently pay the ransom in cryptocurrency. Worse, the payment does not guarantee that the data will not eventually be released on the Dark Web or shared with third parties. In sum, this data breach will likely have long-lasting consequences for the victims.</em></p><ul><li><strong>Vykintas Maknickas, CEO, Saily:</strong></li></ul><p><em>This breach shows that airport cybersecurity is no longer only protecting flight systems or operational infrastructure. The digital services travelers use every day, like airport WiFi, parking bookings, lounge access, and fast-track reservations, have become part of the security perimeter. When these systems are compromised, millions of people can be affected before they even board a plane.</em></p><div><blockquote><p>Email addresses, postcodes, and vehicle registration details can be used to create extremely convincing scams.</p></blockquote></div><p><em>While payment details were reportedly not exposed, the stolen data is still highly valuable to criminals. Email addresses, postcodes, and vehicle registration details can be used to create extremely convincing scams.</em></p><p><em>Travelers may receive fake airport emails, fraudulent parking-payment notices, bogus flight updates, or calls claiming to offer compensation. These messages may contain enough real personal detail to look legitimate, so travellers should stay vigilant.</em></p><p><em>Behind the figure of 8.7 million are real people. Families going on holiday, business travelers heading to meetings, parents trying to keep children entertained at the airport. That is the human cost of a data breach: the company is attacked, but ordinary people live with the consequences.</em></p><p><em>This incident should be a wake-up call for the travel industry. Companies need to ask not only how they protect customer data, but also how much of it they really need to collect and store in the first place. The less unnecessary data a company holds, the less damage criminals can cause when systems are breached.</em></p><p><em>For travelers, the advice is simple: be extra cautious with any unexpected message claiming to come from an airport, airline, parking provider, or customer support team. Do not click links in suspicious emails or texts. When traveling, it is also safer to use mobile data or an eSIM instead of relying on public airport WiFi.</em></p><ul><li><strong>Raghu Nandakumara, VP of Industry Strategy, Illumio:</strong></li></ul><p><em>This is a significant breach affecting a large number of customers ahead of one of the busiest travel periods of the year for UK airports. Incidents like this erode customer trust. For those affected, the exposed data increases the risk of targeted phishing and smishing attempts, where attackers can use legitimate travel-related information to make malicious communications appear convincing.</em></p><div><blockquote><p>Incidents like this erode customer trust.</p></blockquote></div><p><em>While Manchester Airports Group has said the incident was contained and operations were not disrupted, sensitive customer information was still accessed. Maintaining services during a cyberattack is critical, but organisations also need to minimise the amount of data and systems an attacker can reach before the threat is isolated.</em></p><p><em>Measures such as segmentation can help restrict access to critical systems and sensitive data, reducing the risk that a single compromise becomes a wider incident.</em></p><section class="article__schema-question"><h3>How do I submit my own perspective on emerging news?</h3><article class="article__schema-answer"><p>If you have an expert perspective you would like to share on an emerging story or particular topic, please get in contact here: benedict.collins@futurenet.com</p></article></section> </article> ]]>