Manchester Airports Group – 8.7 Million Travellers, and the API Keys Sitting in Plain Sight

A deep-dive into the largest known customer data breach at a British airport operator — and the claimed entry vector any developer could have spotted.

On 27 August 2026, Manchester Airports Group (MAG) — operator of Manchester, London Stansted and East Midlands airports — disclosed that an unauthorised third party had stolen customer data from its commercial systems: car park bookings, lounges, Fast Track and Wi-Fi sign-ups. Roughly 8.7 million customers were affected. For most, the exposure was an email address; parking, lounge and Fast Track customers also lost phone numbers, UK postcodes and vehicle registration plates. No payment data was held in the affected system, and no airport operational systems were touched — flights ra ...