Criminal hackers have published the personal data of nearly nine million people online following a breach of three UK airports. Manchester Airports Group (MAG), which operates Manchester, London Stansted, and East Midlands airports, was extorted by the hackers, but no ransom was paid.
The stolen data includes contact details, vehicle registrations, postcodes, email addresses, phone numbers, addresses, licence plate numbers, purchasing history, and browsing device data. The cyber-crime group is offering the complete dataset for free to other criminals and scammers through their website, which is unusually hosted on the clear internet rather than the dark web, making the data more accessible.
This incident highlights significant risks for any business handling customer data. The widespread release of personally identifiable information (PII) increases the potential for secondary attacks such as phishing, fraud, and identity theft. Businesses must recognise that data breaches can expose their customers to ongoing threats, even if the initial breach is contained.
Cyber security experts warn that individuals affected should be highly vigilant for further scams. The data includes historical and planned future travel information, which could be particularly sensitive for some individuals. The hackers boasted about using the same method to breach each victim: exploiting weaknesses in how companies store digital keys for internal networks.
For UK businesses, this serves as a critical reminder of the importance of robust cyber security measures, secure data storage, and constant vigilance against evolving cyber threats. Protecting customer data is not just a regulatory requirement but a fundamental aspect of maintaining trust and preventing severe financial and reputational damage.