Manchester Airports Group Data Breach Exposed Booking and Wi-Fi Customer Records

Disclosure and timeline

Manchester Airports Group disclosed at 11:48 a.m. UK time on August 27, 2026 that an unauthorized third party had accessed some customer data. The incident covers customer services used across Manchester Airport, London Stansted Airport and East Midlands Airport. MAG said it became aware of the incident on August 25, restricted access to the affected system, engaged external cybersecurity specialists and notified relevant authorities. Its Data Protection team is overseeing the response.

Reporting that cited MAG put the affected population at about 8.7 million customers, with most records limited to an email address. MAG is contacting affected customers directly. The figure should not be treated as a count of disrupted passengers or cancelled bookings. Travelers should determine their status through an official MAG or airport notice and the services they actually used, rather than assuming exposure from the headline number alone.

Affected services and customer records

MAG identified airport parking, lounge and Fast Track bookings, along with airport Wi-Fi registrations, as the affected customer services. Accessed fields included email addresses, telephone numbers, vehicle registrations and postcodes. In combination, those details can make a later message appear specific to a real journey. A sender could reference a parking reservation or vehicle registration and then follow an email with a text message or call.

MAG stated that the accessed system did not hold bank or payment-card details. That distinction is useful when assessing a message that claims payment data must be revalidated because of the breach. Even without card data, however, genuine booking context can support convincing follow-up phishing. Customers should independently open the airport's official website rather than using a link in an unexpected refund, rebooking or account-restoration message.

Airport operations and booking status

The company said airport operations were not disrupted and passenger safety and aviation security were unaffected. Existing parking, lounge and Fast Track reservations remain valid, so customers do not need to cancel or pay again solely because of the incident. Flight status should continue to be checked through the airline or airport's normal operational channels.

As a precaution, the airports temporarily suspended Manage My Booking. Customers who need an urgent change for travel within 72 hours can use the official customer-service route. They should navigate from the airport's own domain or an existing booking confirmation, not from a search advertisement or an unsolicited message. MAG also said it will never unexpectedly ask for payment-card details, banking information or passwords.

Customer response priorities

Check for an official notice from MAG or the airport, but do not begin by pressing a button inside the message. The UK National Cyber Security Centre recommends independently verifying breach communications through the organization's official website. Display names can be forged; the actual domain and the path used to reach support are more reliable. Customers who booked parking, lounges or Fast Track, or who registered for airport Wi-Fi, should open the official incident page directly and follow the support details published there.

1. Open the airport's official domain directly and verify the incident notice and support route.
2. Keep existing valid bookings and reject requests to pay again or create a replacement booking.
3. End any contact that asks for card details, banking information or a password, then recheck through official support.
4. Protect the email account used for travel with a unique password and multi-factor authentication.
5. Report suspicious email, text or phone contact through the relevant official reporting route.

Prioritize messages that mention an airport, parking reservation, lounge, Fast Track, vehicle registration or postcode while demanding an urgent payment or account check. Correct details and fluent wording do not prove that the sender is genuine; exposed information can make a lure more persuasive. Because an email account often holds travel confirmations and receipts, customers who reused its password elsewhere should replace it with a unique password and enable multi-factor authentication. The UK Information Commissioner's Office also recommends strong passwords, MFA and monitoring financial statements after a breach.

Checks for airport and travel-service operators

Operators should clearly separate customer-service data exposure from any effect on operational technology or airport operations. MAG paired that distinction with practical status information: bookings remain valid, Manage My Booking is temporarily unavailable, and urgent changes within 72 hours have a defined support path. Clear boundaries reduce unnecessary customer action and make it harder for scammers to invent a false need for rebooking or repayment.

Airport and travel businesses should map where parking, lounge, priority-security and Wi-Fi records converge, then review retention periods and access rights for each service. Incident communications also need to stay consistent across the website, booking email and contact center. Notices should identify affected services and data fields, valid bookings, temporarily unavailable features and the official route for changes. Support teams should be ready to classify calls about repayment, refunds and account locks, and to verify the exact sender domains and notices used by the organization.

Relevance for travelers outside the UK

International travelers who booked parking, lounges or Fast Track at the three airports, or joined airport Wi-Fi, can apply the same checks. An email address alone can support later contact, and journey-specific context can make a message more credible than generic phishing. If a sender claims that a local bank, card issuer or airline must process a UK airport refund, verify the request against the original airport account and booking reference. MAG's statement that payment data was not held in the accessed system is another useful fact to compare with any demand for repayment.

Operational lessons

The incident shows that airport customer platforms can create a separate security exposure even while flight operations continue normally. Parking, lounges, Fast Track and Wi-Fi improve the passenger journey, but the contact, vehicle and location context behind them can support targeted impersonation. Customers should keep valid reservations, verify notices through official channels and reject any breach-themed request for a new payment or password. Operators should identify the boundaries where customer-service data converges and design access controls and customer communications as connected parts of the response.