Executive Summary

Manchester Airports Group has disclosed on 27 August 2026 that an unauthorized third party accessed customer data belonging to approximately 8.7 million people across three of England’s busiest airports: Manchester, London Stansted, and East Midlands. The incident involved data related to parking lot, lounge and fast-track bookings and in-airport Wi-Fi sign-ups, and the hackers obtained email addresses, phone numbers, vehicle registration numbers and postcodes. The attack was initiated during the peak summer travel season, with millions of families flying back into the UK before the school year begins, but the attack did not disrupt airport operations or flights. MAG says it quickly contained the incident, brought in external cybersecurity experts and notified the relevant authorities, and no group has claimed responsibility, and investigators have not publicly linked the attack to any specific actor.

Key Takeaways

- The system did not store bank or payment details, and according to MAG, most of the 8.7 million affected customers only lost their email addresses, while the impact varies depending on which services they used.

- The combination of an email address, a phone number, and the knowledge that someone recently made a parking or lounge booking gives a convincing starting point for a targeted phishing message. Attackers don’t need payment data if they can impersonate the airport convincingly enough to obtain it themselves.

- As a precaution, MAG temporarily suspended its Manage My Booking service, but all existing reservations remain valid.