Manchester Airports Group Breach: 86 GB Claimed, API Credentials Exposed in Client-Side JavaScript

On August 27, 2026, Manchester Airports Group (MAG) disclosed a data breach affecting customers of Manchester, London Stansted, and East Midlands airports. Two days later, the extortion group FulcrumSec claimed responsibility, stating they had stolen approximately 86 GB of data, a volume far more detailed than indicated in the initial disclosure. According to BleepingComputer, access was allegedly gained by exploiting Iterable API credentials exposed in JavaScript code executed by visitors' browsers.

The Claim and MAG's Response

MAG stated that the breach affected 8.7 million customers, but for most of them only the email address was exposed. The affected services include parking bookings, lounge access, Fast Track, and airport WiFi registrations. According to the company, no payment card or banking data was compromised.

FulcrumSec's version is very different. The group shared data samples with BleepingComputer, including a 21.5 GB export related to Manchester customers. This archive allegedly contains personal identifiers, booking history, and marketing information. BleepingComputer verified one record by comparing it with a real traveler's purchase history: matches emerged on Fast Track bookings, arrival times, terminal information, and amounts paid.

MAG, when contacted by BleepingComputer, did not directly comment on FulcrumSec's specific claims, referring to its own statement and saying it had already contacted affected customers, including those with upcoming bookings. BleepingComputer, for its part, could not independently verify either the number of stolen records or the full extent of the exfiltration.

The Weak Point: API Credentials in Client-Side JavaScript

According to FulcrumSec, data access was achieved through Iterable API credentials, specific to each airport, found in the client-side JavaScript code of MAG's website. Since this code runs in users' browsers, anyone can inspect it using developer tools and potentially view the credentials.

If the claim is accurate, the intrusion required no sophisticated techniques. It was not a zero-day exploit or a ransomware attack: it was enough to read what was already visible to everyone. Iterable is a marketing automation platform; its APIs allow access to contact data, lists, and, in this case, booking details. Exposing API keys in code sent to the browser is a common design flaw, but with potentially serious consequences when the credentials have broad privileges.

The Stolen Data and the Discrepancy Between MAG and FulcrumSec

The data initially disclosed by MAG includes email addresses, phone numbers, vehicle registration plates, and postal codes. According to FulcrumSec, however, the stolen material is much richer: it includes nearly 200,000 records related to trips planned for the rest of 2026, with dates, times, and booking details linked to personally identifiable information.

This discrepancy is significant. If the claim is accurate, the exposure would not be limited to contact information but would include booking history, travel preferences, and marketing data. Such a level of detail allows reconstructing customers' habits, movements, and business relationships.

FulcrumSec stated that it intends to publish the stolen data along with a technical account of the intrusion. However, it added that it might redact records of upcoming trips, acknowledging the risk of concrete harm to individuals.

Why the Risk Is Concrete: Postal Codes and Targeted Phishing

The granularity of British postal codes makes this exposure more critical than an equivalent in the United States. A full UK postcode often identifies a small group of nearby addresses, sometimes a single property, as stated by the Office for National Statistics.

By combining postal codes, vehicle registration plates, parking dates, and booking references, an attacker can craft highly convincing phishing messages. Imagine an email citing a real upcoming trip, with date, terminal, and amount paid: the recipient would hardly distinguish it from an authentic MAG communication. The most sensitive subset is precisely the nearly 200,000 records of future travel, which link identifiable individuals to planned movements.

A Supply Chain Under Pressure: Iterable and the Collins Aerospace Precedent

Security researchers cited in the Security Affairs article point to a possible supply chain theme. Airport operations increasingly depend on third-party platforms for bookings, parking, and loyalty services. Iterable, the marketing platform whose API credentials were allegedly exploited, is exactly this type of external dependency.

This is not the first such incident in the British and European aviation sector. In September 2025, a ransomware attack on Collins Aerospace's check-in software had already disrupted systems at Heathrow, Brussels, and Berlin. Two significant blows within twelve months show how airport infrastructure is exposed not only to its own mistakes but also to those of its suppliers.

What Customers Can Do and the Lessons for Companies

MAG states it is confident it has taken effective measures to protect customers and has contacted all those affected, including those with upcoming bookings. Travelers who recently booked parking, lounge access, or Fast Track are advised to assume that additional travel data may have been exposed and to treat with caution any message citing real booking details.

For companies, the lesson is clear: never expose sensitive API credentials in JavaScript code sent to the browser. Any key or token that ends up in the client is accessible to anyone. Better to use server-side proxies, tokens with limited scope, and periodic credential rotation. In MAG's case, an apparently trivial mistake turned into a mass breach with potential repercussions on the personal safety of millions of travelers.