Cyberattack Exposes Data of 8.7 Million Customers at Three Major UK Airports

Key Takeaways

• Hackers Accessed Data on 8.7 Million Customers: Criminal hackers breached a Manchester Airports Group system containing customer information associated with Manchester, London Stansted and East Midlands airports.
• Most Exposed Data Was Limited to Email Addresses: The majority came from airport WiFi registrations, while some customers also had vehicle registrations, postcodes and other contact details exposed through parking, lounge and fast-track bookings.
• Payment and Banking Information Was Not Compromised: MAG said the breached system did not contain customers’ bank or payment details.
• Aviation Security Was Not Affected: MAG said passenger safety and aviation security were never compromised by the incident.

Deep Dive

Manchester Airports Group said criminal hackers accessed data belonging to about 8.7 million customers in a cyberattack affecting systems used across Manchester, London Stansted and East Midlands airports, one of the largest breaches of customer information disclosed by a UK airport operator.

The attackers gained access to the system over the weekend and demanded a ransom, according to reporting from The Guardian. Most of the compromised data consisted of email addresses collected when passengers signed up for airport WiFi, though some customers had additional information exposed, including vehicle registrations and postcodes.

The intrusion was large in the number of people it touched but, importantly, narrow in what it reached. MAG said the compromised system did not contain customers’ banking or payment information, and the attack did not penetrate the systems responsible for keeping aircraft and passengers safe.

“At no point has passenger safety or aviation security been compromised,” the company said.

There is no indication that flights, terminals or aviation security were endangered. What the attackers found instead was the less dramatic but enormous accumulation of personal information produced by the modern airport around the business of flying: the WiFi login, the parking reservation, the lounge booking, the fast-track purchase.

Most of the exposed data consisted only of email addresses associated with passengers who had registered for WiFi inside airport terminals, MAG said. More detailed information, including vehicle registrations and postcodes, was connected to customers who had used other airport services.

The company did not discover the intrusion until Tuesday. Once it became aware of the attack, MAG said it moved quickly to prevent the hackers from gaining further access, brought in specialist advisers and began notifying affected customers.

“We immediately contained the risk and have been working with specialist advisors and taking appropriate steps to protect our customers and systems,” MAG said. “We have informed and are working with the relevant authorities.”

MAG also apologized for the breach, saying it takes the security of customer information “extremely seriously.”

The absence of payment information limits one obvious avenue for fraud, but it does not make the stolen data harmless. An email address is modest information until it arrives in the hands of someone who knows where it came from. Details connecting a person to an airport, a parking reservation or another travel service can give a fraudulent message the small measure of credibility it needs to survive the first few seconds of suspicion.

MAG has consequently urged customers to pay particular attention to unexpected emails, text messages and phone calls, and to avoid opening attachments they do not recognize.

For the airport group, the breach also exposes a problem that extends well beyond the systems most obviously associated with aviation. An airport does not merely move people through terminals and onto aircraft. It runs an expanding collection of digital services around them, gathering pieces of information at each point where convenience asks for an email address, a postcode or a vehicle registration.

None of those details looks especially consequential on its own. Across 8.7 million customers, they become something else.

That is the scale MAG is now confronting. The systems responsible for aviation safety remained secure, according to the company, and there is no indication that the attackers disrupted the airports themselves. The damage lies instead in information accumulated quietly through millions of routine transactions, much of it surrendered by travelers for something as forgettable as getting online before a flight.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.