Manchester – – October 19, 2026 -- Manchester Airports Group (MAG) has disclosed that an unauthorized third party accessed customer data on approximately 8.7 million people across Manchester, London Stansted and East Midlands airports.
Hackers obtained contact details and vehicle registration numbers
The affected data relates to parking, lounge and fast-track bookings and in-airport Wi-Fi sign-ups. The attackers obtained email addresses, phone numbers, vehicle registration numbers and postcodes.
The attack took place during peak summer travel, as millions of families were flying back into the UK before the school year. Airport operations and flights were not disrupted.
MAG says most affected customers lost only their email address
The affected systems did not store bank or payment details. According to MAG, most of the 8.7 million customers lost only their email addresses, and the impact varies by the services each person used.
Phishing is the main downstream risk
An email address and phone number, combined with the knowledge that someone recently made a parking or lounge booking, gives attackers a convincing basis for targeted phishing. Attackers do not need payment data if they can impersonate the airport well enough to obtain it from the victim.
MAG suspends Manage My Booking as a precaution
MAG temporarily suspended its Manage My Booking service. All existing reservations remain valid.
The company says it contained the incident quickly, brought in external cybersecurity experts and notified the relevant authorities. No group has claimed responsibility, and investigators have not publicly linked the attack to any specific actor.