Manchester Airports Group Cyberattack Exposes Data of About 8.7 Million Customers

MANCHESTER — A cyberattack on Manchester Airports Group (MAG) exposed customer data tied to Manchester Airport (MAN), London Stansted Airport (STN), and East Midlands Airport (EMA), but the operator says operational airport systems were not involved and flights continued without disruption.

The Guardian reported that about 8.7 million customers were affected. The Register said a MAG spokesperson confirmed the current estimate. MAG's public incident page does not give a number, referring instead to "a quantity" of customer data obtained by an unauthorized third party.

What Data Was Obtained

MAG said the data relates to car-park, lounge, and Fast Track bookings as well as airport Wi-Fi sign-ups at the three airports. The information accessed includes email addresses, phone numbers, vehicle registrations, and postcodes.

Neither MAG nor the accessed system held customers' bank or payment details, the operator said. The absence of payment details does not eliminate phishing risk.

MAG said it contacted affected customers directly. It advised them to remain alert for suspicious emails, text messages, or phone calls and said it would not make an unexpected request for payment-card details, banking information, or passwords.

The operator has not publicly identified the third party, explained how access was gained, named the affected system, or stated when the unauthorized access began. Its public notice also does not say whether the listed data fields are exhaustive or whether every affected customer had each type of information exposed.

MAG Reports No Operational Disruption

MAG said the incident did not involve its operational airport systems. The operator reported no operational disruption and no effect on passenger safety or aviation security. Parking services continued normally, and existing bookings remained valid.

The clearest passenger-service consequence was a precautionary suspension of MAG's online Manage My Booking function. Customers did not need to act unless they wanted to change a booking due within 72 hours, in which case MAG directed them to customer service.

MAG's account differs from a September 2025 cyberattack on a shared check-in and boarding supplier, which disrupted passenger processing at several European airports and contributed to delays and cancellations.

The Scale of MAG's Passenger Network

MAG describes itself as the UK's largest airport group. Its three airports handled 66.3 million passengers in the year to March 2026, including 32.3 million at Manchester, 30 million at London Stansted, and nearly four million at East Midlands.

Those traffic figures show the reach of the operator but should not be confused with the breach count. The reported 8.7 million figure refers to customers whose data was involved, not affected flights or 8.7 million disrupted journeys.

MAG said it restricted access to affected systems, hired specialist cybersecurity advisers, and notified relevant authorities. Its public notice does not give a timetable for further updates or for restoring online booking management.