Manchester Airports Group (MAG), the operator of Stansted, Manchester, and East Midlands Airports, has confirmed a cybersecurity incident that resulted in unauthorized access to personal data of approximately 8.7 million individuals.
The breach, discovered on August 26, 2026, and believed to have occurred a few days prior, exposed data related to car park, lounge, and fast-track bookings, as well as in-airport Wi-Fi sign-ups. The compromised information primarily includes email addresses and phone numbers, with vehicle registration details and postcodes also accessed for a portion of the affected customers.
A spokesperson for MAG stated that bank details were not revealed in the security incident. For the majority of affected customers, only email addresses were accessed. MAG has notified customers via email, advising them to be vigilant about unexpected communications claiming to be from the company and reminding them that MAG will never request payment or banking information unexpectedly.
Customers have been informed that no immediate action is required, but they should continue to exercise normal caution regarding unsolicited emails and text messages. The scale of the breach ranks it among the largest in the UK in recent times, although unlike some previous high-profile data hacks, airport operations have remained unaffected.
MAG has not disclosed the specific method used by cyber attackers to target its systems.