Manchester Airports Group, which runs Manchester, London Stansted and East Midlands airports, confirmed on Thursday that an intruder took customer data from one of its systems. The information comes from bookings for car parks, lounges and Fast Track security lanes, and from people who signed up for WiFi inside the terminals.
According to the company's statement, the stolen records contain postcodes, vehicle registration numbers, phone numbers and email addresses. MAG says that neither it nor the system that was accessed holds customers' bank or card details, so no payment data was involved. It also says flights and security screening were never at risk, and that the three airports are operating normally.
The group is the largest airport operator in the United Kingdom, handling more than 66 million passengers a year. It has not said how many customers are caught up in the incident, only that everyone affected has been contacted directly.
One visible consequence is that the online Manage My Booking service has been taken down as a precaution. Customers who need to change or cancel a booking in the next 72 hours are being sent to a phone line instead, and the company warns that waiting times may be longer than usual. Existing bookings remain valid and travelers do not need to do anything about them.
MAG says that once it became aware of the intrusion it restricted access to the affected system, brought in outside security specialists and informed the authorities. It has given no details about how the attacker got in or when. So far no ransomware or extortion group has publicly claimed responsibility.
Small details, useful to a fraudster
At first glance the list of stolen fields looks modest. There are no passwords, no card numbers and no passport details. The combination is still more useful to a criminal than it appears.
A full British postcode narrows a home down to a handful of properties, typically around 15 addresses. Put that next to a number plate, a mobile number and an email address, and add the knowledge that the person recently booked airport parking, and a scammer has everything needed to make a fake message look real. A text that quotes the right car and the right airport and asks the recipient to pay a small parking surcharge or confirm a booking is far more likely to be believed than a generic one.
There is a second, less obvious concern. Parking bookings come with dates. A record showing that a car will be in a long stay car park for two weeks also suggests that a particular home will be empty for that time. MAG's statement does not say whether booking dates were part of the stolen data, and customers will want that question answered.
The company is telling customers to be wary of unexpected emails, texts and phone calls, and not to click links or open attachments in them. It stresses that it will never get in touch out of the blue to ask for card details, banking information or passwords. Anyone who receives such a request in MAG's name should treat it as fraud.
