Skip to main contentSkip to footer
Skip to content 
Key Takeaways
- MAG Data Breach affected roughly 8.7 million customers without disrupting a single flight or terminal.
- Reported Entry came via third-party platform credentials, not malware, exploits or lateral movement.
- Only 15% of UK Businesses formally review the cyber risks posed by immediate suppliers.
- Verizon recorded third-party involvement in 48% of confirmed breaches during 2026, up 60%.
- Cyber Security and Resilience Bill introduces 24-hour reporting and turnover-linked fines for in-scope organisations.
- Fortray Tech helps UK businesses map third-party exposure, monitor SaaS identity activity and evidence compliance readiness.
On 27 August 2026, Manchester Airports Group told customers that an unauthorised third party had taken their data. No flights were cancelled, no terminals closed, and no baggage system went dark. Yet roughly 8.7 million people who booked parking, a lounge, fast track security, or simply signed onto airport Wi-Fi at Manchester, London Stansted, or East Midlands now have their details circulating in criminal hands.
That absence of operational drama is precisely why UK boards should pay attention. This was not an attack on runways. It was an attack on the quiet commercial layer that sits behind almost every modern business, and most organisations have no idea how large that layer has grown. Fortray Tech, a UK managed service provider, helps businesses find and secure the supplier data they no longer control.
What Really Happened at Manchester Airports Group?
MAG confirmed that email addresses, phone numbers, vehicle registration numbers, and postcodes were accessed, and said neither it nor the affected system held bank or payment details. Passenger safety and aviation security were not compromised. The company restricted access to the affected systems, brought in specialist advisers and notified the relevant authorities, while suspending its Manage My Booking service.
The extortion group FulcrumSec claimed responsibility, telling BleepingComputer it had taken roughly 86GB of data, including a 21.5GB customer export and close to 200,000 records tied to travel booked for the rest of 2026. Samples reportedly contained purchase and booking references, prices, parking dates and times, IP addresses, approximate locations, device information and historical spend — considerably more than the original disclosure suggested. MAG has confirmed the data came from a third-party database and that it received a ransom demand.
FulcrumSec is not a ransomware crew in the traditional sense! Since 2025, it has actively stolen data and threatened publication rather than encrypting systems, with previous claims against LexisNexis, Novo Nordisk and Avnet.
