Extortion Group FulcrumSec Claims 86GB Manchester Airports Group Data Theft

Extortion group FulcrumSec claims they stole 86GB of Manchester Airports Group data after finding API credentials exposed in client-side JavaScript.

Manchester Airports Group (MAG) disclosed a data breach on August 27 affecting customers of Manchester, London Stansted, and East Midlands airports. Two days later, BleepingComputer reports the extortion group FulcrumSec claimed responsibility, saying it stole roughly 86GB of data, considerably more detailed than what MAG’s original disclosure suggested.

MAG’s own statement describes a relatively limited set of exposed data. It says the breach affected car park, lounge, Fast Track bookings, and airport WiFi registrations, exposing email addresses, phone numbers, vehicle registrations, and postcodes.

MAG disclosed that the data breach impacted 8.7 million customers, however, the company says most of those customers had only their email addresses exposed.

FulcrumSec tells a different story. The group shared samples with BleepingComputer that included a 21.5GB export of Manchester customer data, with personal identifiers, historical booking details, and marketing information. BleepingComputer checked one record against a real traveler’s purchase history and found matching Fast Track bookings, arrival times, terminal information, and payment amounts.

The alleged way into the system is particularly concerning. FulcrumSec says it found airport-specific Iterable API credentials inside client-side JavaScript. That code runs in users’ browsers, so anyone inspecting the website with developer tools could potentially see those credentials.

“The group claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript and that the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026.” states the report. These records allegedly contain dates, times and booking information linked to personally identifiable information. FulcrumSec says it intends to publish the stolen data and a technical account of the intrusion. If the claim is accurate, attackers did not need a highly sophisticated technique. They simply found sensitive API credentials exposed in code that the website sent directly to customers’ browsers.”

The most concerning specific claim is nearly 200,000 records tied to upcoming travel through the rest of 2026, complete with dates, times, and booking details linked to identifiable individuals. BleepingComputer couldn’t independently verify that number or the full scope of what was actually taken, and MAG declined to directly address FulcrumSec’s specific claims when asked, instead pointing to its existing statement that affected customers with upcoming bookings had already been contacted. MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, a spokesperson said, without engaging with the 86GB figure or the exposed-credentials claim directly.

FulcrumSec plans to publish the stolen data but may redact upcoming travel records because of the risk of real-world harm. UK postcodes can identify very small groups of addresses, and combined with vehicle registrations, parking dates and booking details, the data could enable highly convincing phishing messages targeting people with upcoming trips.

UK postcodes make this exposure sharper than the equivalent breach might be in the US. Unlike American ZIP codes covering broad delivery areas, a full UK postcode typically identifies a small cluster of neighboring addresses, sometimes a single property, according to the Office for National Statistics. Combined with vehicle registrations, parking dates, and specific booking references, that’s more than enough raw material for a phishing message referencing a real upcoming trip that would be very hard to distinguish from a genuine MAG communication.

Security researchers commenting on the broader incident have flagged a supply-chain angle worth watching. Airport operations increasingly run through third-party platforms for booking, parking, and loyalty services rather than systems the airport itself directly controls, and Iterable, the marketing platform whose API credentials FulcrumSec claims to have abused, is exactly that kind of outsourced dependency. This also isn’t aviation’s first bad year: a September 2025 ransomware attack on Collins Aerospace‘s check-in software had already grounded systems at Heathrow, Brussels, and Berlin, meaning UK and European aviation infrastructure has now taken two significant hits inside twelve months.

MAG says no payment card or banking data was exposed, however, travelers who recently booked parking, lounge access or Fast Track should assume more travel data may be exposed and treat messages citing real booking details with caution.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Manchester Airports Group (MAG))