BBC says hackers accessed data on about 8.7 million airport customers and demanded a ransom.
Why it matters: The breach exposes a large pool of travelers and raises cyber, regulatory and vendor-risk concerns for a major UK airport operator. MAG says core airport operations were not affected, but the incident could still drive notification, scrutiny and claims risk.
- Manchester Airports Group says an unauthorized third party obtained customer data tied to car park, lounge and Fast Track bookings, plus in-airport Wi-Fi sign-ups.
- BBC reported the attackers accessed data belonging to about 8.7 million airport customers and demanded a ransom.
- MAG said the incident affected Manchester, Stansted and East Midlands airports in the UK.
- The company said bank details and payment card information were not compromised, and flights and security operations were unaffected.
Manchester Airports Group said it was hit by a cyber security incident and that an unauthorized third party obtained customer data tied to car park, lounge and Fast Track bookings, plus in-airport Wi-Fi sign-ups across Manchester, Stansted and East Midlands airports. The company said it became aware of the incident on Tuesday, Aug. 25, 2026, and later disclosed it publicly on Aug. 27.
BBC reported that hackers accessed data belonging to about 8.7 million airport customers and demanded a ransom. MAG said the compromised information included customer contact details and other booking-related data, but not bank details or payment card information. MAG's incident notice said: "Manchester Airports group has been subject to a cyber security incident by an unauthorised third party."
The company also said operations were not disrupted. "A quantity of customer data has been obtained that relates to car park, lounge and Fast Track bookings and in-airport WIFI sign-ups," MAG said. It added that flights, security and day-to-day operations remained unaffected.
ITV News reported the breach affected customers of Manchester Airports Group and quoted the company apologizing for the inconvenience and concern caused. The affected airports are in the United Kingdom.
By the numbers
- 8.7 million - BBC's estimate of affected airport customers.
- 3 - airports named by MAG: Manchester, Stansted and East Midlands.
- 2 days - time between MAG saying it became aware of the incident and public disclosure.
Yes, but: The available sources do not identify the attacker group, confirm whether a ransom was paid or specify whether any regulator has opened a formal inquiry.
What's next: MAG has already issued its public notice; further updates may come from the company, BBC reporting or UK regulators if they weigh in.