The breach affected three airports, not only Manchester
Manchester Airports Group, usually shortened to MAG, operates Manchester Airport, London Stansted Airport and East Midlands Airport. On 27 August 2026, it disclosed that an unauthorised party had gained access to a system containing information associated with approximately 8.7 million customers across the group.
The affected records were reported to relate to airport car parking, lounges, FastTrack bookings and in-airport Wi-Fi. MAG said airport operations, passenger safety and aviation security were not affected. It also said the system did not hold banking or payment-card details.
What has been reported
- The incident concerns Manchester, London Stansted and East Midlands airports.
- Approximately 8.7 million customer records were affected.
- The information included email addresses, telephone numbers, postcodes and vehicle registration numbers.
- The records related to services including parking, lounges, FastTrack and airport Wi-Fi.
- MAG said the affected system did not contain payment-card or banking details.
- The attack and its consequences remain under investigation.
What data was accessed
The risk does not depend only on whether financial information was present. Contact and travel-related details can help a criminal make a message appear genuine, particularly when the recipient recognises the airport, service or vehicle being mentioned.
The reported information and how it could be misused
| Information | Possible misuse | What to watch for |
|---|---|---|
| Email address | Booking-themed phishing or false account alerts | Messages asking you to follow a link, confirm a booking or make an urgent payment. |
| Telephone number | Fraudulent calls or text messages | Callers or messages claiming to be an airport, parking operator, airline or bank. |
| Postcode | More convincing impersonation | A message using a correct location detail as supposed proof that it is genuine. |
| Vehicle registration | Parking, fine or vehicle-themed scams | False parking charges, refund offers or claims that a vehicle booking must be corrected. |
No payment data does not mean no risk
MAG's statement that the affected system did not hold banking or payment-card information is important. It reduces one immediate risk, but it does not make the exposed contact and booking-related information harmless. Several ordinary details can be combined to create a persuasive scam.
What is known, and what is still under investigation
This distinction matters. A company announcement can confirm that a security incident happened without resolving whether every legal duty was met. Equally, the existence of a breach does not by itself prove negligence, financial loss or entitlement to compensation. Those questions depend on evidence and, where relevant, the regulator's or a court's assessment.
What affected customers should do now
A proportionate response
Keep the breach notification. Save the original email or letter, including its date, sender details and any reference number.
Treat unexpected contact with care. Open the airport or service website yourself instead of following a link in a message.
Secure the email account connected with your bookings. Use a strong unique password and enable multi-factor authentication where available.
Change reused passwords. There is no public confirmation that passwords were accessed, but a password used for more than one account should be replaced, particularly if you notice suspicious activity.
Check relevant accounts and bookings. Look for unfamiliar changes, password-reset messages, parking claims or payment requests.
Report suspicious messages. Do not reply, provide security codes or transfer money. Contact your bank immediately if you have disclosed banking information or made a payment.
Should everyone replace a bank card or change every password?
Not on the information currently available. MAG said the affected system did not contain banking or payment-card data, and there has been no public confirmation that account passwords were accessed. Cancelling a card merely because of this announcement may create disruption without reducing the identified risk.
The better response is targeted. Change any password that was reused, strengthen the security of the email account connected with the booking and act immediately if a bank or account provider identifies suspicious activity. Follow the advice of the relevant provider if later evidence shows that additional credentials were affected.
Ask MAG what happened to your data
A general announcement may not tell an individual exactly which of their records were involved. Affected customers can ask MAG to clarify whether their data was included, which categories were affected, which service or booking the information related to and what protective action the company recommends.
A focused request you can adapt
Please confirm whether my personal data was affected by the cyberattack announced on 27 August 2026. If it was, please identify the categories of my data involved, the airport service or booking from which it came, when the unauthorised access occurred, the likely consequences for me and the measures taken or proposed to address the risk. Please also provide the appropriate contact details for any follow-up data protection questions.
Keep the request focused
A subject access request can be useful where you need a copy of your personal data, but it does not automatically entitle you to confidential cybersecurity material, every internal investigation document or information about other people. Ask first for the information needed to understand your own exposure and the response to it.
When to complain to the ICO
Start by raising the specific concern with MAG and keep its response. A complaint is stronger when it identifies what information is missing, what answer appears inadequate and what outcome you are seeking. If the organisation does not respond properly or you remain concerned about how your personal data has been handled, you can then ask the Information Commissioner's Office to consider the matter.
The ICO can assess data protection concerns and decide whether regulatory action or recommendations are appropriate. It does not act as a compensation service and cannot award damages to an individual. Keep the breach notice, your correspondence, suspicious messages and evidence of any loss or distress so that each issue can be supported rather than asserted generally.
Compensation is not automatic
Article 82 UK GDPR provides a route to compensation for material or non-material damage caused by an infringement. That does not mean every person named in a breach automatically receives a payment. A claimant would normally need to identify the relevant infringement, the damage suffered and the causal link between them.
Why this matters beyond one airport group
Travel services collect ordinary details at several points: a car registration for parking, a telephone number for a booking, an email address for confirmation and a postcode for payment or identification. Each item can appear low-risk in isolation. Together, they can reveal a credible story about where somebody travelled and which services they may recognise.
For consumers, the useful lesson is not panic. It is to preserve the evidence, verify contact through an independent route, secure the account that controls password resets and ask precise questions when an organisation's notice is too general. That approach is more protective than clicking every warning link or making an unsupported compensation claim.
The bottom line
The MAG incident is significant because of its scale and the combination of customer information involved. The reported absence of banking data and operational disruption should be recognised, but it should not be mistaken for an absence of consumer risk.
Affected customers should be especially careful with airport, parking and booking-themed contact. The remaining questions should be answered by the continuing investigation and any later regulatory findings, not by speculation. ConsumerWise will distinguish those findings from the facts already established if the position changes.
Sources and further guidance
- The Guardian: UK airports operator says customer data accessed in cyberattackContemporary reporting on MAG's announcement, the scale of the incident and the data involved.
- Financial Times: Manchester Airports Group cyberattackReporting on the incident, affected airports and the continuing investigation.
- NCSC: Phishing scamsOfficial guidance on recognising and reporting suspicious emails, text messages, calls and websites.
- ICO: Personal data breachesGuidance for people concerned that an organisation has lost or exposed their information.
- ICO: Make a data protection complaintHow to raise a concern with an organisation and take it to the ICO.
- UK GDPR, Article 34Rules on communicating a high-risk personal data breach to affected people.
- UK GDPR, Article 82The statutory route for compensation where an infringement causes material or non-material damage.
