The Manchester Airports Group data breach: What can we learn about the risks of public airport Wi-Fi registration from a GDPR perspective?

This informal CPD article ‘The Manchester Airports Group data breach: What can we learn about the risks of public airport Wi-Fi registration from a GDPR perspective?’ was provided by Educage Training, a team of legal and technical professionals specializing in data protection, information security, and regulatory compliance.

A legal analysis in light of EU and UK data protection law

On 27 August 2026, the Manchester Airports Group (MAG) announced that an unknown external party had gained unauthorised access to customer data held for the three UK airports it operates (Manchester, London Stansted and East Midlands)¹. According to the company, the attack affected neither airport operations nor aviation security, nor the physical safety of passengers; however, according to a company spokesperson, the number of customers affected is estimated at around 8.7 million², a figure that is orders of magnitude greater than the number of individuals affected by most previous UK data breaches.

The incident is also notable because it is not an isolated IT mishap, but a scenario that is now typical: 

• the attackers tried to monetise the stolen data through extortion, 
• the company refused to pay, 
• and the perpetrators then published the stolen data^4,5. 

Drawing on publicly available primary and secondary sources, this article reconstructs the sequence of events and then analyses the legal consequences in detail from the perspective of the EU GDPR and the UK GDPR.

1. Timeline of the incident

• According to MAG’s own statement and reporting by Recorded Future News, the intrusion was detected on Tuesday, 25 August 2026; the attackers are thought to have accessed the system a few days earlier, over the preceding weekend².
• On Thursday, 27 August 2026, MAG publicly announced the incident and began emailing affected customers^1,2.
• On 30 August 2026, BleepingComputer reported that a ransom group called FulcrumSec had claimed responsibility, stating that it had obtained around 86 GB of compressed data; the outlet verified a sample record and found it to be genuine³.
• On 2 September 2026, TechRadar reported that MAG had refused to pay the ransom, after which the attackers published the data. The group claimed the full dataset could amount to as much as half a terabyte⁴.
• On 3 September 2026, ITPro also confirmed the publication and reported expert opinions on the expected wave of fraud⁵.
• On 2 September 2026, the Have I Been Pwned database also added the incident, listing a total of 8.8 million affected customers⁶.

2. What did the attackers obtain?

According to MAG’s official statement, the affected system contained customer data relating to parking, lounge and Fast Track bookings, as well as airport Wi-Fi registrations¹. The company specifically emphasised that neither MAG nor the affected system stores payment card or other financial data:¹

Data type: Email address and phone number

MAG’s official statement: Was accessible

Security significance: Can be used for targeted phishing, smishing and vishing attacks

Data type: Vehicle registration number and postcode

MAG’s official statement: Was accessible

Security significance: Makes fraud more credible; may indicate parking and travel habits

Data type: Parking, lounge, Fast Track and Wi-Fi registration data

MAG’s official statement: Was accessible

Security significance: Provides context for realistic, personalised fraud

Data type: Payment card and financial data

MAG’s official statement: Not affected – the system did not store this data

Security significance: Criminals may nonetheless try to obtain it afterwards through deception

The sample examined by BleepingComputer painted a considerably more detailed picture. The outlet identified a specific passenger record as genuine, containing previous Fast Track purchases, booking and arrival times, the terminal used, amounts paid, and the presumed purpose of travel³.

The attackers claim to have also obtained a roughly 21.5 GB Manchester customer export containing customer IDs, booking history and marketing categorisation³, and claim to also hold close to 200,000 records linked to future travel for the remainder of 2026³. The group also stated that it obtained access using airport-specific Iterable API keys exposed in client-side JavaScript code³. MAG has neither publicly confirmed nor denied these claims³, so the precise picture regarding the volume and scope of the data currently rests partly on the attackers’ statements and partly on partially verified samples.

3. The refusal to pay and the publication of the data

In line with official recommendations, MAG refused to pay the ransom ^4,5. The decision was professionally justified: payment would not have guaranteed deletion of the data, and would have funded criminal activity. The consequence, however, was that FulcrumSec published a significant portion of the stolen data – according to its own claims, the entire dataset obtained ^4,5. Based on publicly available sources, the completeness of the published dataset cannot be independently verified. This fundamentally changes the risk profile. 

While the data remained within a closed extortion channel, the risk to those affected depended, in practice, on the intentions of a single criminal group; once published, anyone who accesses the leaked archive can use it for targeted fraud⁵.

Security experts studying the case have pointed out that publishing the data for free is a deliberately deterrent message to future victims, and is not merely punishment for MAG but a warning to every other organisation that refusing to pay can result in the data of millions being made public⁵. It has also been suggested that, using AI-based tools, criminals are now able to assemble phishing campaigns on a mass scale yet still tailored to individuals, based on the leaked data⁴.

4. Legal analysis: EU and UK GDPR considerations

4.1 Which regime applies?

Since Brexit, the UK GDPR – the amended version of the EU GDPR that continues to apply in UK law – together with the provisions of the Data Protection Act 2018, forms the general data protection framework in the United Kingdom. Compliance with this framework is supervised by the Information Commissioner’s Office (ICO).^10,11 As MAG is a company registered in the UK, and the incident concerns data processing linked to UK airports, the primary regulatory framework is the UK GDPR, under the jurisdiction of the ICO.

However, the extraterritorial scope of the EU GDPR may also be engaged. Under Article 3(2) GDPR, it is not sufficient in itself that a MAG service is accessible online to a person located in the Union. The key question is whether the specific processing activity relates to the offering of goods or services that MAG demonstrably targets at data subjects located in the Union, or involves monitoring their behaviour within the Union.⁸⁹ A parking or Fast Track booking made at a UK airport by a person travelling from the EU does not, therefore, in itself prove EU targeting within the meaning of Article 3(2).

Where Article 3(2) GDPR applies to the specific processing in question, the data subject may also avail themselves of remedies under the EU GDPR. In that case, the obligation to appoint an EU representative under Article 27 GDPR must also be examined, taking into account the exceptions set out in Article 27(2).^8,9 That obligation therefore does not depend merely on whether MAG processes data relating to a large number of individuals in the Union, but above all on whether the conditions for territorial scope under Article 3(2) are met.

Based on currently publicly available information, it is not known whether MAG has a designated EU representative, or whether a separate notification or complaint relating to the incident has been made to an authority in an EU Member State. These questions only become relevant under the EU GDPR if territorial scope under Article 3(2) can actually be established for the specific processing concerned.⁸⁹

4.2 Possible infringement of data protection principles

Both the UK GDPR and the EU GDPR set out, among other things, the principles of purpose limitation and data minimisation in Article 5.^8,10 In relation to this incident, however, public sources do not allow for a precise determination of which specific service each data type was collected under. According to MAG’s statement, the same affected system contained data relating to parking, lounge and Fast Track bookings, as well as airport Wi-Fi registrations1. It does not follow from this, however, that the vehicle registration number or postcode, for example, would have been requested during Wi-Fi registration; the vehicle registration number could naturally have been linked to the parking service.

If part of the affected data was processed for marketing or profiling purposes, the controller was required to identify an appropriate GDPR legal basis for those purposes and to provide data subjects with adequate information.^8,10 The applicable legal basis, and any consent requirement, also depend on the specific marketing activity involved; in the case of electronic direct marketing, the PECR rules may also be relevant in the United Kingdom.¹²

The range of data uncovered by BleepingComputer – marketing categorisation, customer profiles, device data, IP addresses and approximate location data³ – suggests that the affected system may have formed part of a wider set of customer data linked to several airport services. Based on public information, however, it cannot be established exactly which of these more detailed data items originated from Wi-Fi registration and which came from other services.

This may raise the question of compliance with the requirements of data protection by design and by default (Article 25 GDPR).^8,10 If a system collects and stores a wider range of data than is necessary, or one disproportionate to its purposes, this increases the risk to data subjects in the event of an incident. In addition, FulcrumSec’s claim that API keys embedded in client-side JavaScript code enabled access3, if confirmed, raises the question of the adequacy of technical and organisational measures under Article 32 GDPR and the corresponding UK GDPR provision.^8,10

4.3 Notification obligations

Both the UK GDPR and the EU GDPR require the controller to notify the competent supervisory authority without undue delay, and where feasible no later than 72 hours after becoming aware of the personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the risk is high, data subjects must also be informed without undue delay.^8,10

According to public statements, MAG notified the competent authorities^1,2, and emailed affected customers to alert them to phishing attempts^1,2. An important legal question is whether this information, given during the incident’s first, apparently more limited phase, when the company stated that in the vast majority of cases “only” an email address had leaked², was proportionate, and whether, following the publication of the data, once it emerged that far more detailed data, including travel and booking data, could be affected^3,4, supplementary, updated information was required. The incident’s risk assessment must be reviewed in light of new information; according to ICO guidance, risk classification and the decisions built on it may change as further facts come to light.¹³ This may make it necessary to supplement or update the information previously provided to data subjects.

4.4 Processor chain and liability

If and to the extent that Iterable or another third party acted as a processor on MAG’s behalf in the specific processing concerned, the processor relationship may be subject to the contractual and organisational requirements of Article 28 GDPR/UK GDPR.^8,10 The publicly available information alone is not sufficient to determine Iterable’s legal role with certainty. Where a processor relationship exists, the controller’s liability cannot automatically be transferred to the processor, and the processor is also subject to obligations to notify the controller of incidents.

4.5 Sanctions and legal consequences

Under the UK GDPR and the Data Protection Act 2018, the higher maximum fine is 4% of the undertaking’s total worldwide turnover in the preceding financial year, or £17.5 million, whichever is higher.^11,14 The corresponding upper limit under the EU GDPR is €20 million, or, in the case of an undertaking, 4% of its total worldwide annual turnover for the preceding financial year, whichever is higher.⁸ The actual amount of any fine is influenced by numerous factors: the gravity and duration of the infringement, the number of data subjects affected, the controller’s willingness to cooperate with the authority, and any history of prior infringements.

In addition, under Article 82 GDPR and the corresponding UK data protection rules, data subjects may claim compensation if they have suffered material or non-material damage causally linked to the data protection infringement.^8,15 Under EU law, a mere infringement of the GDPR is not, in itself, sufficient for compensation: an infringement, damage, and a causal link between them are required. 

The Court of Justice of the European Union has held, however, that a well-founded fear of the future misuse of personal data can, in certain circumstances, in itself constitute non-material damage, provided the data subject adequately demonstrates its negative consequences.¹⁶ An incident affecting 8.7–8.8 million individuals may therefore carry significant mass claims and litigation risk^2,6.

5. Why is public Wi-Fi registration a critical point?

One of the most important, practical lessons of this case is that registering for public Wi-Fi networks – in this case, airport Wi-Fi – is far from a risk-free routine task. Public Wi-Fi registration interfaces (so-called captive portals) are particularly risky from a data protection perspective when they involve processing that is broader than what is necessary to provide network access. 

In this case, MAG’s statement confirms that, alongside Wi-Fi registrations, the affected system also included data relating to parking, lounge and Fast Track bookings¹. The sources do not, however, prove that every affected data type – for example the vehicle registration number or postcode – was collected specifically during Wi-Fi registration.

• Where Wi-Fi registration, or the related processing of customer data, involves a third-party platform, the controller must also properly assess the processor chain and the provider’s technical and organisational safeguards. In this case, some of the details concerning Iterable’s role derive from the attackers’ claims and secondary sources³, so a precise data protection legal assessment requires further evidence.^8,10
• Data relating to the different services affected by the incident – such as phone number, postcode, vehicle registration number and booking history – can, when combined, enable the crafting of extremely credible, personalised phishing messages. An attacker can refer to a genuine parking, booking or airport service event, thereby increasing the credibility of the deception^4,5.
• At the moment of registration, users typically do not consciously weigh up the data protection risks, since the immediate goal – internet access – pushes the long-term data processing consequences into the background.
• The use of public Wi-Fi can also introduce a separate layer of technical risk, particularly where the network is inadequately secured or traffic is unencrypted. Modern HTTPS significantly reduces the risk of content interception, but does not eliminate all network or metadata exposure. This technical risk is distinct from the central issue in the present incident, namely that an unauthorised party gained access to customer data held by the provider.

The lesson is therefore twofold:

• First, providers must consistently apply the GDPR/UK GDPR data minimisation principle to Wi-Fi registration processes as well.^8,10 Data not necessary for providing network access should only be processed for a proper, separate purpose and legal basis; in the case of electronic communications for marketing purposes, the PECR may impose further requirements.¹²
• Second, users also need to act more thoughtfully: before entering a phone number or other identifying data that does not appear necessary for network access on a public Wi-Fi registration interface, it is worth checking whether providing that data is mandatory, for what purpose it is collected, and whether a less data-intensive alternative, such as a mobile data connection, is available.

6. Practical recommendations for those affected

• Only handle matters relating to bookings, parking or refunds through the official website or app, and do not follow links in messages from unknown sources¹.
• Do not automatically assume that a call or message is genuine just because it knows your vehicle registration number, postcode, or a previous use of an airport service – this data may now be publicly accessible^3,4.
• Under no circumstances provide payment card or other financial data in response to a request purporting to come from MAG, as the company has expressly stated that it never asks for such data unexpectedly¹.
• Use a unique password and, where possible, phishing-resistant, multi-factor authentication for your email account, as email access is often also used to reset passwords for other services.
• Keep suspicious messages – the sender, the phone number, the link referenced – and report them to the relevant provider and the national authority.

7. Summary and conclusion

Two closely related lessons can be drawn from the Manchester Airports Group case:

• The first is technical and organisational: a customer database that is separate from the core operational systems, yet still holds a large volume of detailed data – parking, lounge, Fast Track, Wi-Fi – represents, on its own, a substantial attack surface and significant legal risk, even where critical infrastructure, in this case airport operations, remains unaffected. 
• The second is legal: the case simultaneously raises questions about the applicability of the UK GDPR and the EU GDPR, the possible infringement of the principles of data minimisation and data protection by design, and the need for notification and information obligations to be met on an ongoing basis, adjusted to changes in risk.

The most important conclusion for everyone, however, is an awareness of the risks of registering for public – including airport – Wi-Fi networks. One of the key lessons of such incidents is that data linked to various airport services which, at first glance, seem harmless – such as contact details, vehicle registration numbers, postcodes and booking history – can, when combined, form the basis of extremely credible, personalised fraud, particularly once the data becomes widely accessible^3,4,5. Based on public sources, however, it cannot be stated that every data type listed was collected during Wi-Fi registration.

For this reason, both providers and users must exercise heightened caution regarding personal data provided during public Wi-Fi registration. Providers must limit their data requests to the necessary minimum, and users, before any such registration, should ask themselves whether providing the data in question is genuinely necessary for a simple internet connection.

The contents of this article are provided for general informational and scientific outreach purposes only, and do not constitute legal advice or a legal opinion of any kind. The content is based on the analysis of publicly available sources and is not intended to assess specific legal situations or individual cases. The author and/or publisher strive for accuracy and currency in the content but accept no liability for any omissions, outdated information, or direct or indirect damages arising from the use of the material described herein. The relevant legislative environment, together with its regulatory and judicial practice, may change continuously; the article should not, therefore, be regarded as an exhaustive or up-to-date summary of the law currently in force. 

We hope this article was helpful. For more information from Educage Training, please visit their CPD Member Directory page. Alternatively, you can go to the CPD Industry Hubs for more articles, courses and events relevant to your Continuing Professional Development requirements.

References

1. Manchester Airports Group: Data Security Incident – Update & FAQs (official statement), 27 August 2026. 

2. Alexander Martin: Cyberattack on Manchester Airports Group exposes data of 8.7 million customers. The Record from Recorded Future News, 27 August 2026. 

3. Ax Sharma: FulcrumSec claims Manchester Airports hack, theft of 86 GB of data. BleepingComputer, 30 August 2026 (updated: 3 September 2026). 

4. Benedict Collins: Manchester Airports hackers post data of 8.7m people after failed extortion. TechRadar, 2 September 2026. 

5. Nicole Kobie: Manchester Airports Group attack: Millions of holidaymakers urged to look out for scams as hackers publish stolen data online. ITPro, 3 September 2026. 

6. Have I Been Pwned: Manchester Airports Group data breach. Added: 2 September 2026. 

7. Rob Nidschelm: Manchester Airports Said No to the Ransom. The Attackers Answered With the Passenger Data. BlackTree, 27 August 2026 (updated: 5 September 2026). 

8. Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)

9. European Data Protection Board: Guidelines 3/2018 on the territorial scope of the GDPR (Article 3). 

10. UK General Data Protection Regulation (UK GDPR), the amended version of Regulation (EU) 2016/679 as applicable in the United Kingdom. 

11. Data Protection Act 2018 (UK). 

12. Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended. 

13. Information Commissioner’s Office: Understanding and assessing risk in personal data breaches. 

14. Information Commissioner’s Office: The maximum amount of a fine under UK GDPR and DPA 2018. 

15. Information Commissioner’s Office: Taking your case to court and claiming compensation. 

16. CJEU, judgment of 14 December 2023, VB v Natsionalna agentsia za prihodite, C-340/21, ECLI:EU:C:2023:986, in particular on the question of non-material damage under Article 82 GDPR and a well-founded fear of future misuse.