A cybersecurity incident targeting three major UK airports has resulted in unauthorized access to the personal data of approximately 8.7 million customers.
According to Operative Information Center-OMM, Manchester Airports Group (MAG), which operates the airports, has issued an official statement regarding the incident.
The group, which manages Manchester, London Stansted, and East Midlands airports, confirmed that passenger and aviation security remains uncompromised and that no payment or banking information was leaked.
The majority of the compromised data consists of email addresses collected during the use of terminal Wi-Fi services. Additionally, the cyberattack exposed phone numbers, vehicle registration numbers, and postcodes associated with airport reservations. Flight schedules and terminal operations at all three airports continue to function normally.
In a statement, a MAG spokesperson confirmed that Manchester Airports Group had been subjected to a cybersecurity incident carried out by an unauthorized third party. According to the spokesperson, the breach involved customer data related to car parking, lounge services, fast-track bookings, and Wi-Fi registrations at the Manchester, Stansted, and East Midlands airports.
The statement noted that the risk was immediately contained, and necessary measures were taken in collaboration with expert consultants to protect systems and customers. Relevant authorities have been notified and are cooperating in the process. The company emphasized that there has been no disruption to operations, and airport activities and parking services are continuing as normal.
The spokesperson reiterated that neither MAG nor the compromised systems store customer banking or payment information. The company expressed its commitment to data security and apologized for any concern caused by the incident.
In an email sent to customers, MAG advised them to remain vigilant against unexpected emails, calls, or messages that appear to be from airport management. Customers were reminded that they will never be asked for payment or banking details in unsolicited communications.
