Manchester Airports Group

FulcrumSec claimed the theft of 86 GB compressed, roughly 640 GB extracted, from Manchester Airports Group, which operates Manchester, Stansted and East Midlands airports. The group says it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript.

That detail is the whole incident. Client-side JavaScript is served to every visitor by design. A credential placed there is not stolen so much as collected. Manchester Airports Group stated that at no point was passenger safety or aviation security compromised, which addresses a different question than the one the data raises.

Email addresses and phone numbers for 8.8 million customers, plus vehicle registrations and parking history, Fast Track purchases and lounge bookings. Also purchase references, booking status, IP addresses, device data and full UK postcodes. No payment card data was found.

Nearly 200,000 records relate to travel still upcoming during the remainder of 2026. A vehicle registration tied to a full postcode tied to a dated parking booking says which car belongs to which household and when that household will be away from it. That combination is not a marketing record. It is a burglary schedule.

Passengers who parked a car. The set is skewed toward people who used the paid services, which means the exposed group is the one that gave the airport the most information about itself.

For the 200,000 with travel still ahead, the risk is immediate and physical rather than financial. For everyone else it is targeted phishing with unusually good props: a real booking reference, a real registration plate, a real lounge purchase. Fraud that quotes accurate details back to a victim converts at a rate generic fraud never reaches.

Using a managed marketing platform is the conventional choice. Iterable is a legitimate service, and pushing customer engagement to a specialist is what most organizations of this size do rather than building it in house.

The intent behind a client-side key is usually narrow, scoped to a single low-risk call. What went wrong is the gap between the permission somebody assumed the key carried and the permission it actually carried, in a place where anybody could read it.

Nobody knew the credential was in the JavaScript. That is the finding, and it is not unusual. Secrets in client-side code, configuration and repositories are the category of exposure that inventories consistently miss, because they are content inside files rather than records inside a database.

The second thing nobody knew was what the marketing platform could actually reach. A system holding email addresses for campaign delivery had also accumulated vehicle registrations, parking histories, postcodes and forward travel dates. Each field arrived for a defensible reason. Nobody added them up.

The 86 GB figure compresses to 640 GB extracted. An organization that had read its own marketing estate would have known both numbers before FulcrumSec published them.

FulcrumSec claimed it, published customer and booking data, and characterized the access as obtained rather than hacked. Have I Been Pwned has indexed the breach, which puts affected addresses into a database ordinary people can check.

There is no ransomware and no encryption event here, which is why the airport could truthfully say operations and aviation security were unaffected. The data left anyway. Those two facts are not in tension, and conflating them is how an accurate statement produces a misleading impression.

Keeping the credential server side. A key that never reaches the browser cannot be read out of the browser, and nothing about the marketing use case required it to be there.

The larger fix is scanning your own front end and your own marketing estate for exactly this. A key in served JavaScript is discoverable by anyone, which means it is discoverable by you first if anybody looks. FulcrumSec found it by reading a public file. That search was available to Manchester Airports Group at any point, at no cost, before it was available to anyone else.