Nobody puts the terminal WiFi portal on the risk register.
Manchester Airports Group — which runs Manchester, London Stansted and East Midlands — disclosed this week that criminals accessed customer data belonging to roughly 8.7 million people. The stolen fields are email addresses, postcodes and vehicle registration numbers. MAG says the attackers demanded a ransom and that it refused to pay.
The group identified the incident on Tuesday, says it contained it, brought in specialist advisers and began notifying affected customers. It has told the BBC it knows who the attackers are, while declining to name the group publicly or disclose the sum demanded. The UK’s Information Commissioner’s Office has confirmed it received a breach notification and is assessing it.
The systems that don’t feel like systems
The detail that makes this worth a business reader’s attention is where the data lived. Most of the exposed records came from passengers signing up for WiFi in the terminals. The rest came in through car-park reservations, lounge bookings and fast-track security purchases.
None of those is an operational system. MAG has been explicit that passenger safety, airport operations and aviation security were unaffected, and that the compromised environment held no bank account or payment-card data. Every one of those statements is true and none of them makes the problem smaller.
The WiFi portal is a marketing asset. It exists to trade internet access for an email address. Over years and tens of millions of passengers, that trade quietly assembled one of the larger consumer datasets in British transport — held in a system that was never designed, funded or reviewed as though it held one. The parking and lounge platforms did the same thing with richer fields attached: a postcode and a licence plate are worth considerably more to a fraudster than an email alone.
Our take: The absence of card data is being reported as mitigation. It isn’t, particularly. Card fraud is bounded, insured and reversible. What was taken here is the raw material for extremely convincing phishing — a real email address, a real postcode, a real vehicle registration, all tied to a real airport the person actually used. A fake parking-charge notice quoting your own number plate is a different proposition from a generic scam text, and MAG has already warned customers to expect exactly that. The broader lesson is a boring one that most companies still get wrong: data liability accumulates wherever a form field does, not wherever the security budget goes. If your marketing stack has been collecting email addresses for a decade, your marketing stack is a target, and it is almost certainly not defended like one. The same pattern showed up in workplace monitoring apps this month.
What to watch
- The ICO’s assessment. The regulator will decide whether MAG met its obligations under UK data-protection law. A refusal to pay a ransom does not affect that question either way.
- Whether the data is published. Groups that get refused typically leak. If the dataset appears, the phishing wave follows within days.
- Attribution. MAG says it knows who did this. Whether that becomes public — and whether the group has hit other transport operators — determines if this is one company’s bad week or a campaign.
- Copycat exposure at your own firm. The practical takeaway is an inventory question: which customer-facing conveniences have been collecting personal data on autopilot, who owns them, and when were they last reviewed? For most businesses the honest answers are “several”, “nobody” and “never”.