Ransomware Attack Hits Three UK Airports, Exposing Data of 8.7 Million Customers

Key points

• Manchester Airports Group (MAG) confirmed that hackers accessed data for 8.7 million customers across its three UK airports: Manchester, East Midlands, and London Stansted.
• Stolen data includes email addresses, phone numbers, vehicle registration numbers, and postcodes, primarily from WiFi sign-ups, car park bookings, and lounge access.
• MAG stated that the hackers demanded a ransom for the return of the data, which the company refused to pay; the specific amount was not disclosed.
• The incident was detected on Tuesday, and MAG claims to have immediately contained the risk and notified relevant authorities, including the Information Commissioner's Office (ICO).
• MAG assured the public that passenger safety, aviation security, and payment systems were not compromised, and airport operations remain unaffected.
• The breach occurred during the peak summer travel season, with 54 million passengers using these airports combined last year.

Background

This incident follows a wave of high-profile cyber-attacks against UK infrastructure and major retailers in 2025, including breaches at Jaguar Land Rover, Marks & Spencer, and Harrods. The UK government has increased pressure on national infrastructure operators to improve cyber-defences following these events. Additionally, a recent cyber-attack linked to Iran caused a temporary shutdown of a British power plant, highlighting ongoing threats to critical systems. The breach at MAG joins a broader pattern of data exposure incidents, such as the Chick-fil-A loyalty data breach in June 2026, where third-party credentials were used to access customer information.

How outlets are covering it

BBC and The Guardian report consistent facts regarding the scale of the breach (8.7 million customers) and the types of data stolen (email, phone, vehicle, postcode). Both outlets emphasize MAG's statement that aviation security was not compromised. The Guardian adds context about the peak travel season and quotes a legal expert, Lauren Wills-Dixon, noting that airports hold large amounts of customer data due to services like parking and WiFi, increasing cyber-attack risks. The Telegraph source was inaccessible due to a bot challenge, so no additional perspectives could be extracted from it. All available sources agree that MAG refused to pay the ransom and has notified authorities.

Why it matters

The breach affects nearly 9 million individuals, raising concerns about data privacy and the vulnerability of critical infrastructure to cyber-attacks. The exposure of personal details like postcodes and vehicle registrations increases the risk of identity theft and phishing. The incident highlights the need for stronger cyber-defences in the UK aviation sector, especially as airports handle large volumes of customer data through digital services. It also underscores the ongoing threat of ransomware attacks on major UK companies and infrastructure.

What to watch

MAG is working with specialist advisors and relevant authorities to protect customers and systems. The Information Commissioner's Office (ICO) is assessing the breach report. Customers are urged to remain vigilant against suspicious communications and avoid opening unknown attachments. MAG has stated that it will continue to take appropriate steps to protect customer data and systems, and the incident may lead to increased scrutiny of cyber-defences in the UK aviation sector.