Manchester Airports Group confirmed in late August 2026 that an unauthorised third party had obtained customer data from systems serving Manchester, Stansted and East Midlands airports. Reporting puts the affected population at around 8.7 million customers. The data covers car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups: email addresses, phone numbers, vehicle registrations and postcodes. Payment and bank details were not stored on the affected system, per the company, and the intrusion — which ran over a weekend and was discovered on Tuesday 25 August — touched neither operations nor aviation security.
The Commercial Estate, Not The Aviation One
Nothing here approaches the passenger-processing layer this database filed at 25-0919, where a supplier incident degraded four countries’ terminals. What was reached is the retail business wrapped around the journey — parking, lounges, queue-skipping, Wi-Fi — which is where an airport actually accumulates customer identity at scale, because every one of those products requires an account and a registration plate where boarding a flight does not.
What These Fields Say Together
A vehicle registration tied to a postcode, an email address and a car park booking with dates is a compact statement of who is away from home, when, and what is parked where. The inference argument filed at 26-0306 applies without modification: no single field is sensitive, and the join is — a burglary-relevant dataset assembled from parking convenience. The realistic mass harm is parking-fine and booking-refund phishing that quotes true details; the sharper edge is what the join reveals about any individual worth targeting.
Three Airports, One Dataset
One group operating three airports pooled their customer sign-ups in one place, so one intrusion reached the customers of all three. The consolidation is ordinary corporate hygiene, and it produced the concentration this database records wherever a group structure meets a shared platform: the blast radius is the group’s, not any single airport’s.
Compiled from the company’s confirmation as reported and contemporaneous coverage, listed below. The 8.7 million figure is from reporting rather than a company statement in the material reviewed, and the file is graded medium largely on that. No actor claim existed at filing. Corrections: corrections@forensicpost.com.