Manchester Airports Group refuses ransom after cyberattack hits 8.7 million passengers

Extortion attempt and refusal

A criminal hacking group demanded an undisclosed ransom from Manchester Airports Group after accessing personal records belonging to 8.7 million customers. The digital intrusion occurred over the preceding weekend and was first disclosed by the operator on 26 August 2026. The airport group, which manages Manchester Airport, London Stansted Airport, and East Midlands Airport, refused to pay the extortion sum and aligned its actions with guidance from British law enforcement. The cybercriminal syndicate responsible is known to authorities in the United Kingdom and has carried out similar intrusion campaigns against commercial entities worldwide this year. Forensic evaluations found no indication of involvement by foreign states. Manchester Airports Group confirmed that the unauthorized entry point was identified and closed rapidly after detection.

Manchester Airports group has been subject to a cyber security incident by an unauthorised third party.

Compromised booking data and digital services

The compromised records were primarily email addresses collected when passengers logged into terminal Wi-Fi networks across the three hubs. A smaller subset of records contained customer telephone numbers, residential postcodes, and vehicle registration plates linked to airport parking, lounge access, and Fast Track reservations. Manchester Airports Group confirmed that its breached systems did not store bank account details or credit card information, preventing the loss of financial assets. The group, which employs more than 7,000 people and operates the CAVU digital travel services business, temporarily shut down its online Manage My Booking platform. Customers needing to adjust existing reservations were instructed to complete changes by telephone.

Operational continuity and institutional response

Flight schedules, runway operations, and passenger processing across all three locations continued without disruption throughout the breach. Manchester Airports Group confirmed that physical aviation safety, terminal security, and car park facilities remained fully functional. The company reported the breach to the National Cyber Security Centre and lodged a formal notification with the Information Commissioner's Office, the data protection regulator for the United Kingdom. External cybersecurity advisers were brought in to investigate the intrusion and bolster digital defences. Security assessments confirmed that the stolen data had not appeared on dark web marketplaces.

At no point has passenger safety or aviation security been compromised.

Passenger scale and security recommendations

The three regional hubs handle substantial travel volumes, with Manchester Airport serving over 32 million passengers, London Stansted recording approximately 30 million, and East Midlands handling around 4 million passengers over the past year. Manchester Airports Group notified affected customers by email on the morning of 27 August 2026, advising them to exercise vigilance regarding phishing messages. The notification instructed travellers that the operator will never make unsolicited contact requesting payment credentials. Security guidance distributed after the breach advised individuals to update account passwords and use independent breach-verification platforms to monitor their exposed credentials. The incident follows earlier cyberattacks against British commercial and cultural bodies, including Jaguar Land Rover, Marks and Spencer, Harrods, Co-op, and the British Library.