Reports on the cyber incident agree that customer information was accessed across three UK airports, but place different emphasis on the risk: the scale of the affected customer base versus the operator’s assurances that core airport systems and payment data were untouched.

The breach has put millions of travellers’ personal details in focus without disrupting flights or airport services. Manchester Airports Group (MAG), which runs Manchester, Stansted and East Midlands airports, says it contained the incident after learning of it on Tuesday.

One account highlights the breadth of information obtained, reporting that data linked to about 8.7 million customers included email addresses, phone numbers, vehicle registrations and postcodes, as well as records connected to parking, lounges, Fast Track bookings and airport Wi-Fi registrations. MAG said the affected systems did not store bank or payment details, and that bookings would remain valid.¹

A second report similarly focuses on the large number of people affected, while adding MAG’s assessment that email addresses accounted for the data exposed for the “vast majority” of customers. It said customers had been advised to be particularly wary of unexpected messages purporting to come from the airport group, while MAG stated: “We will never contact you unexpectedly to ask for payment or banking information.”²

The two accounts converge on MAG’s central reassurance: passenger safety, aviation security and daily operations were not compromised. The group said it had “immediately contained the risk” and was working with specialist advisers and relevant authorities.¹ It also acknowledged the potential concern for customers, apologising while maintaining that parking services and upcoming reservations continued as normal.²