Manchester Airport Group (MAG), which operates London Stansted, East Midlands Airport, and Manchester Airport, has been struck by a significant cyber attack resulting in mass customer data theft.
The group confirmed on Thursday that an “cyber security incident by an unauthorised third party” had resulted in the seizure of customers’ email addresses, phone numbers, vehicle registrations, and postcodes.
MAG said it became aware of the incident on Tuesday and moved swiftly to shut down further access by the hackers to its systems.
“We immediately contained the risk and have been working with specialist advisors and taking appropriate steps to protect our customers and systems,” the group said in a statement.
Customers notified by the company were reassured that the compromised system did not hold any bank or payment details, limiting the direct financial exposure of those affected.
Around 8.7 million customers are believed to have had their personal data accessed during the breach, making it one of the more significant airport-related cyber incidents in recent UK history.
Stansted wrote directly to affected customers urging them to remain vigilant against follow-up scams that could exploit the stolen data.
In its email to customers, Stansted wrote: “We would urge you to be particularly cautious of unexpected emails, calls or text messages claiming to be from us. We will never contact you unexpectedly to ask for payment or banking information. We apologise for any inconvenience or concern this may cause.”
MAG confirmed that airport operations remain “unaffected” by the breach, with flights and services continuing normally across all three of its airports.
The hackers have since been identified and relevant authorities have been informed, the group added, though no further details about the perpetrators were disclosed publicly.
The breach arrives against a backdrop of growing financial pressure on UK businesses facing cyber threats, with large firms collectively spending heavily on legal defence and recovery.
Research from insurance giant Gallagher and the Centre for Economics and Business Research (CEBR) found that cyber attacks cost firms with over 250 employees an estimated £11.7bn in total losses.
Direct losses from disrupted trading represented the single largest expense at £5.4bn, while shareholders pursued legal action costing large UK businesses a combined £3.7bn to defend.
Lost assets accounted for a further £1.3bn for affected companies, while regulatory fines added £108m on top of those already significant costs.
Firms also lost £573m in costs relating to reputational damage, with nearly £400m in revenue lost as customers cancelled contracts, reduced spending, or switched to alternative suppliers following incidents.