MAG data breach exposes traveler information at three UK airports

What happened at Manchester Airports Group

Manchester Airports Group (MAG) announced that its computer systems were accessed by unauthorised actors in early June. The intrusion resulted in the theft of data collected from Wi Fi sign up forms and other customer interactions at Manchester, Stansted and East Midlands airports.

Scope of the stolen data

The information taken includes names, email addresses, phone numbers and the dates when travellers registered for free Wi Fi service. No payment details or passport numbers were reported as compromised.

Wi Fi sign up name and email
Contact phone number
Timestamp of the Wi Fi registration
Airport location where the sign up occurred

MAG stated that the breach does not affect flight booking records or baggage handling systems.

Immediate response by MAG

Within hours of confirming the breach, MAG engaged a leading cyber security firm to investigate the incident and to secure its networks. The company also notified the UK Information Commissioner’s Office and began notifying affected passengers via email.

MAG’s press release highlighted three key actions:

Full forensic analysis of the affected systems
Implementation of additional security controls, including multi‑factor authentication for staff accounts
Ongoing monitoring for any signs of further unauthorised activity

Regulatory implications

The breach falls under the UK General Data Protection Regulation, which requires organisations to report personal data incidents to the regulator within 72 hours. The UK Information Commissioner’s Office (UK Information Commissioner’s Office) is expected to review MAG’s response and may issue guidance or enforcement action.

In addition, the National Cyber Security Centre advises that any organisation handling large volumes of personal data should adopt a zero‑trust architecture and regularly test its incident response plans.

Advice for affected travellers

Passengers who received a notification from MAG should take the following steps to protect themselves:

Do not click on any links or open attachments in unexpected emails. Verify the sender’s address before responding.
Change passwords for any accounts that use the same email address, especially if the same password was reused elsewhere.
Enable two‑factor authentication on all accounts that support it.
Monitor bank statements and credit reports for any unusual activity.

MAG has set up a dedicated help line and a web portal where travellers can check whether their details were part of the breach.

Broader cybersecurity lessons

The incident underscores the importance of protecting even seemingly low‑risk data such as Wi Fi sign up information. Cyber criminals often use harvested contact details for phishing campaigns, which can lead to more serious compromises.

Key takeaways for organisations include:

Encrypt data at rest and in transit, regardless of its perceived sensitivity.
Conduct regular penetration testing and vulnerability scanning on public‑facing services.
Maintain an up‑to‑date inventory of all third‑party vendors and assess their security posture.
Provide staff training on recognising social engineering attempts.

For further guidance on preventing data breaches, see the NCSC data breach guidance. The BBC Technology regularly covers emerging threats and best practices for individuals and businesses.

As investigations continue, MAG has pledged to keep passengers informed and to work closely with regulators to ensure compliance with data protection laws.