Cybercrooks jet off with Manchester Airports Group customer data
- ID
- 18639
- Status
- summarized
- Published
- 27 Aug 2026, 8:52 PM
- Fetched
- 27 Aug 2026, 11:46 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/27/cybercrooks-jet-off-with-manchester-airports-group-customer-data/5292943
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 3.5
- Created
- 27 Aug 2026, 11:47 PM
- Tags
- Audience
- developerssaas_founders
What happened
Manchester Airports Group (MAG), operating three UK airports, confirmed that an extortion group stole data affecting 8.7 million customers during a recent cybersecurity incident. The breach was not ransomware; the overwhelming majority of compromised records were email addresses collected during public Wi-Fi sign-up, with smaller amounts from speculative parking/Fast Track enquiries and completed bookings. MAG described it as a sophisticated hack rather than a human-error lapse, said the stolen files came from a database hosted by a third party, and has not paid the extortionists.
Why it matters
The concrete takeaway for builders is the third-party-hosted database exposure: MAG was compromised through one of its systems, but the exfiltrated data sat in a vendor-managed database, which is a common architecture that shifts blast radius outside your direct control. If you rely on third-party hosted databases for customer data, this is a prompt to verify what access controls and monitoring your vendor exposes to you and whether your incident response plan accounts for a breach you cannot directly contain.
Discussion angle
When your customer data lives in a third-party hosted database, who owns incident response and breach notification — and does your contract actually spell that out?