MAG’s 27 August 2026 statement said an unauthorised third party obtained customer data from car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups at Manchester, London Stansted and East Midlands airports (emails, phones, vehicle registrations, postcodes; no bank details; operations unaffected).

The BBC (2 September 2026) reports that criminal hackers posted the personal data of nearly nine million people online after breaching the three airports, and that they extorted MAG for an undisclosed amount but failed to get their ransom paid; it quotes MAG saying it has contacted all those affected, including everyone with upcoming bookings. (source: BBC News)

A group calling itself FulcrumSec claimed responsibility, according to Computer Weekly. (source: Computer Weekly) Have I Been Pwned, which added the data on 2 September 2026, lists about 8.8 million affected email addresses and phone numbers, with names, browser user agent details, IP addresses, purchases and vehicle registration plates also present. (source: Have I Been Pwned)

MAG’s original mediacentre statement remains the operator notice.

Correction (22 Oct 2026): the headline previously stated the leak came 'after ransom refusal' as fact; MAG has not said so, and the BBC reports only that the hackers failed to get their ransom paid. (source: BBC News)

Correction (29 Oct 2026): removed claims made by FulcrumSec that no confirmed source supports, and a SecurityWeek link.