Manchester Airports Group (MAG) has confirmed a significant cybersecurity incident involving the personal information of approximately 8.7 million customers. The breach, which was identified on August 25, 2026, targeted systems managing services at three major British hubs: Manchester (MAN), London Stansted (STN), and East Midlands (EMA). While a substantial volume of data was accessed by an unauthorized third party, the operator has assured the public that aviation security and flight operations remain entirely unaffected.
Scope of the Data Exposure
The cyberattack specifically targeted databases containing information from passengers who utilized ancillary airport services. According to MAG, the compromised files include details from individuals who booked car parking, business lounge access, and fast-track security services, as well as those who registered for in-terminal Wi-Fi. The categories of personal data accessed during the breach include:
- Email addresses (the most frequently accessed data point)
- Contact phone numbers
- Vehicle registration numbers
- Postal codes
MAG representatives emphasized that no banking or payment card information was stored within the affected systems, meaning financial data remains secure. The company has engaged specialist cybersecurity advisors to conduct a forensic investigation and has notified the relevant regulatory authorities.
Operational Status and Passenger Safety
Despite the scale of the data theft, there has been no disruption to the day-to-day running of the airports. All three locations—Manchester, which handled over 32 million passengers last year, Stansted, and East Midlands—continue to operate according to their regular schedules.
At no point has passenger safety or aviation security been compromised. The incident has not resulted in any operational disruption. Airport operations remain unaffected and customer parking services continue to operate normally.
As a precautionary measure, the group has temporarily suspended the "Manage My Booking" online portal. Travelers needing to modify reservations scheduled within the next 72 hours are advised to contact customer service centers directly, though wait times may be longer than usual due to increased inquiry volumes.
Recommendations for Travelers
Security experts warn that the exposure of email addresses and phone numbers could lead to targeted phishing and smishing campaigns. MAG has started contacting affected individuals via email to provide guidance on protecting their digital identity. Passengers are urged to exercise extreme caution regarding any unsolicited communications claiming to be from the airport group.
Official protocol dictates that MAG will never contact customers unexpectedly to request passwords, bank details, or immediate payments. Travelers are advised to avoid clicking links or downloading attachments from suspicious emails and to report any fraudulent activity to the Information Commissioner’s Office (ICO) or local law enforcement agencies.