--- title: "Airport WiFi sign-ups turn into a national data… | Firevault" description: "Manchester Airports Group has confirmed that criminal hackers accessed the data of about 8.7 million customers across Manchester, East Midlands and London…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/manchester-airports-group-data-breach-87-million-customers-2026#webpage", "url": "https://fire-vault.com/news/manchester-airports-group-data-breach-87-million-customers-2026", "name": "Airport WiFi sign-ups turn into a national data…", "description": "Manchester Airports Group has confirmed that criminal hackers accessed the data of about 8.7 million customers across Manchester, East Midlands and London…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/manchester-airports-group-data-breach-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/manchester-airports-group-data-breach-87-million-customers-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/manchester-airports-group-data-breach-87-million-customers-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed", "item": "https://fire-vault.com/news/manchester-airports-group-data-breach-87-million-customers-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed", "description": "Manchester Airports Group has confirmed that criminal hackers accessed the data of about 8.7 million customers across Manchester, East Midlands and London Stansted. Most of it came from free terminal WiFi sign-ups and from car parking, lounge and fast-track bookings.", "url": "https://fire-vault.com/news/manchester-airports-group-data-breach-87-million-customers-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/manchester-airports-group-data-breach-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/manchester-airports-group-data-breach-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/manchester-airports-group-data-breach-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/manchester-airports-group-data-breach-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-08-27T13:53:02.220108+00:00", "dateModified": "2026-08-28T08:03:36.979668+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/manchester-airports-group-data-breach-87-million-customers-2026" }, "inLanguage": "en-GB", "articleSection": "Insight", "wordCount": 902, "keywords": "Airport, Insight, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What happened Manchester Airports Group, the owner of Manchester, East Midlands and London Stansted airports, has confirmed a cyber security incident in which criminal hackers accessed the data of about 8.7 million customers. According to [BBC News](https://www.bbc.co.uk/news/articles/c7v4353rry7o), the group said contact details, vehicle registrations and postcodes were obtained at the weekend", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What data was taken in the Manchester Airports Group breach?", "acceptedAnswer": { "@type": "Answer", "text": "Manchester Airports Group said hackers accessed customer contact details, vehicle registrations and postcodes. Most of the records were email addresses collected from terminal WiFi sign-ups, with more detailed records coming from car parking, lounge access and fast-track bookings. The group said the system did not hold bank or payment details." } }, { "@type": "Question", "name": "How many people were affected by the airport data breach?", "acceptedAnswer": { "@type": "Answer", "text": "The data of about 8.7 million customers across Manchester, East Midlands and London Stansted airports was accessed." } }, { "@type": "Question", "name": "Was flight safety or aviation security affected?", "acceptedAnswer": { "@type": "Answer", "text": "Manchester Airports Group stated that at no point was passenger safety or aviation security compromised during the incident." } }, { "@type": "Question", "name": "Why is an email address breach still serious?", "acceptedAnswer": { "@type": "Answer", "text": "An email address tied to a specific airport confirms that a person travels and gives criminals a credible pretext for fraud. Combined with a vehicle registration, a postcode and a parking booking, it can indicate a home location and a period of absence, which supports convincing phishing and targeted crime." } }, { "@type": "Question", "name": "How would Offline Secure Storage have reduced the exposure?", "acceptedAnswer": { "@type": "Answer", "text": "Offline Secure Storage holds retained records in physically disconnected storage, so historic WiFi, booking and marketing data is not reachable from the internet. The live service keeps only the records it needs, which reduces the volume an intruder can access without reducing what the organisation is able to retain." } } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview What happenedWhy the numbers are so largeWhy email addresses and number p…The Firevault viewWhat organisations should do nowSourcesMore Resources [Knowledge Vault](/learn/knowledge)/ [News](/learn/knowledge?filter=news) News · Insight · 27 August 2026 # Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed Manchester Airports Group has confirmed that criminal hackers accessed the data of about 8.7 million customers across Manchester, East Midlands and London Stansted. Most of it came from free terminal WiFi sign-ups and from car parking, lounge and fast-track bookings. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 5 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fmanchester-airports-group-data-breach-87-million-customers-2026)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fmanchester-airports-group-data-breach-87-million-customers-2026&text=Airport%20WiFi%20sign-ups%20turn%20into%20a%20national%20data%20problem%20as%208.7%20million%20customer%20records%20are%20accessed%0A%0AManchester%20Airports%20Group%20has%20confirmed%20that%20criminal%20hackers%20accessed%20the%20data%20of%20about%208.7%20million%20customers%20across%20Manchester%2C%20East%20Midlands%20and%20London%20Stansted.%20Most%20of%20it%20came%20from%20free%20terminal%20WiFi%20sign-ups%20and%20from%20car%20parking%2C%20lounge%20and%20fast-track%20bookings.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fmanchester-airports-group-data-breach-87-million-customers-2026)[](mailto:?subject=Airport%20WiFi%20sign-ups%20turn%20into%20a%20national%20data%20problem%20as%208.7%20million%20customer%20records%20are%20accessed&body=Manchester%20Airports%20Group%20has%20confirmed%20that%20criminal%20hackers%20accessed%20the%20data%20of%20about%208.7%20million%20customers%20across%20Manchester%2C%20East%20Midlands%20and%20London%20Stansted.%20Most%20of%20it%20came%20from%20free%20terminal%20WiFi%20sign-ups%20and%20from%20car%20parking%2C%20lounge%20and%20fast-track%20bookings.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fmanchester-airports-group-data-breach-87-million-customers-2026) ![Passengers using self-service check-in kiosks in a busy airport terminal with streams of light representing customer data leaving the building](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/manchester-airports-group-data-breach-2026.jpg) Passengers using self-service check-in kiosks in a busy airport terminal with streams of light representing customer data leaving the building Why it matters ## What this means for organisations holding critical data Manchester Airports Group has confirmed that criminal hackers accessed the data of about 8.7 million customers across Manchester, East Midlands and London Stansted. Most of it came from free terminal WiFi sign-ups and from car parking, lounge and fast-track bookings. In this analysis 1. 01 [What happened](#section-0) 2. 02 [Why the numbers are so large](#section-1) 3. 03 [Why email addresses and number p…](#section-2) 4. 04 [The Firevault view](#section-3) 5. 05 [What organisations should do now](#section-4) **On this page**[What happened](#section-0)[Why the numbers are so large](#section-1)[Why email addresses and number p…](#section-2)[The Firevault view](#section-3)[What organisations should do now](#section-4) ## What happened Manchester Airports Group, the owner of Manchester, East Midlands and London Stansted airports, has confirmed a cyber security incident in which criminal hackers accessed the data of about 8.7 million customers. According to [BBC News](https://www.bbc.co.uk/news/articles/c7v4353rry7o), the group said contact details, vehicle registrations and postcodes were obtained at the weekend. The group became aware of the incident on the Tuesday, stopped further access, notified affected customers and informed the relevant authorities. It stated that passenger safety and aviation security were never compromised, and that the system involved did not hold bank or payment details. The majority of the accessed records were customer email addresses collected when passengers signed up to free WiFi inside the terminals. The more detailed records, including vehicle registrations, came from customers who booked car parking, lounge access or fast-track security. ## Why the numbers are so large Nothing about this incident required an attacker to reach a flight system, a baggage system or a payment platform. The exposure came from the ordinary commercial edge of an airport: the marketing database that sits behind a WiFi splash page, and the booking systems for parking and lounges. That is exactly where volume accumulates. A single terminal can capture tens of thousands of email addresses in a week, and it keeps them. Three airports operating for years produce a dataset of national scale, held in a system that is permanently online because it has to serve a captive portal and a booking website. The result is a familiar shape. A low-sensitivity system holds a very high-volume dataset, stays connected at all times, and retains that data long after the commercial reason for holding it has expired. ## Why email addresses and number plates matter It is tempting to treat this as a minor breach because no payment data was involved. That underestimates what the attackers now hold. - An email address linked to a named airport tells a criminal that the person travels, and gives a credible pretext for a phishing message about a booking, a parking charge or a refund. - A vehicle registration linked to a postcode and a parking booking is close to an address, a movement record and a period of absence from home. - Combined, the set supports convincing fraud at scale, which is why customers are being urged to be cautious about unexpected emails, messages and calls, and to avoid opening attachments from unknown contacts. Under UK data protection law, a large volume of contact data is still personal data, and the obligation to hold it securely and only for as long as necessary does not soften because the fields look harmless. ## The Firevault view The technical failure here is secondary. The structural failure is retention. Every one of those 8.7 million records was reachable because it was sitting in a connected system that no longer needed to hold it. A WiFi sign-up from three years ago does not need to be online. A completed parking booking from last season does not need to be online. Yet in most organisations there is no defined destination for data that must be kept but must not remain exposed, so it stays in the live estate by default. "An airport does not need eight point seven million email addresses within reach of the internet," said Mark Fermor of Firevault. "It needs a small amount of that data live, and the rest held somewhere an attacker cannot route to. The moment data has no operational reason to be connected, leaving it connected is a decision, not an accident." This is what [Offline Secure Storage](/offline-secure-storage)® is for. Records that must be retained for commercial, legal or analytical reasons are moved to storage that is physically disconnected, so the volume of data an intruder can reach is a fraction of the volume the organisation holds. The service stays online. The archive does not. Two controls follow from that principle: 1. **Reduce the connected footprint.** Keep only the records the live service needs, and move historic marketing, booking and customer records into [Offline Secure Storage](/how-it-works/offline-secure-storage), where they remain retrievable but unreachable. 2. **Contain the path, not only the data.** Where operational and customer-facing systems share networks, use a designed containment control so a compromise in the commercial estate cannot be widened. Our [containment blueprint](/control-blueprints/cp-02) sets out how that separation is enforced physically rather than by configuration alone. Airports are critical national infrastructure with a very large consumer business attached to them. The consumer business is where the record counts live, and it is usually the least protected part of the estate. That is the gap worth closing. ## What organisations should do now - Establish how many customer records are held, and how many of them the live service actually requires. - Set a retention period for WiFi, booking and marketing data, and enforce it. - Move retained records that are not needed live into [physically disconnected storage](/storage). - Test recovery from that storage, so disconnection never becomes an obstacle during an incident. - Assume that contact data alone is enough to enable fraud, and warn customers accordingly. If you are unsure which of your datasets should be disconnected, the [OSS Concierge](/find-my-oss) works through the data, the operating model and the architecture that fits. ## Sources - BBC News, "Hackers steal data from millions of airport customers": [https://www.bbc.co.uk/news/articles/c7v4353rry7o](https://www.bbc.co.uk/news/articles/c7v4353rry7o) - Statement from Manchester Airports Group, as reported by BBC News About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Access decided by you, not assumed by the network Control by Firevault removes standing pathways and replaces them with connection windows you approve, so stolen credentials and compromised suppliers have nothing standing to abuse. [Get started](/get-started)[Talk to the team](/demo) **No standing access**Paths exist only when you open them **Verification**Identity confirmed before any connection is made **Containment**A compromised account cannot reach what is disconnected **Control**Every window and closure is under your command Related Reading ## You may also find these useful [ ![T-Mobile pulled the plug on Salt Typhoon. It took a car journey to get there.](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/tmobile-power-pull-salt-typhoon-2026.jpg) Insight ### T-Mobile pulled the plug on Salt Typhoon. It took a car journey to get there. T-Mobile's security chief ended months of failed software remediation by driving to the data centre, clearing ID, finding the cabinet and physically pulling the power supply from the compromised hardware. Disconnection was the right control. Firevault Control is designed to take the same action in under six milliseconds. 27 Aug 2026 7 min ](/news/tmobile-severs-network-cable-salt-typhoon-hackers-2026)[ ![Beacon breach: 1,500 charities exposed and an HIV charity's health data stolen](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/george-house-trust-beacon-charity-data-breach-2026.jpg) Insight ### Beacon breach: 1,500 charities exposed and an HIV charity's health data stolen People supported by a Manchester HIV charity have been told sensitive health information may have been stolen after a breach at Beacon, the shared database platform used by more than a thousand UK charities. One supplier, one connected database, national exposure. 26 Aug 2026 3 min ](/news/beacon-charity-database-breach-hiv-charity-health-data-2026)[ ![Iran-linked hackers shut down a UK power plant for four days](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg) Insight ### Iran-linked hackers shut down a UK power plant for four days A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK power generation. The grid held. The control layer did not. 23 Aug 2026 4 min ](/news/iran-linked-hackers-uk-power-plant-shutdown-2026)[ ![GTA 6 leaks: a nightmare or a blip for the biggest video game of the year?](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/gta6-leaks-rockstar-2026.jpg) Insight ### GTA 6 leaks: a nightmare or a blip for the biggest video game of the year? Unreleased Grand Theft Auto 6 footage has appeared online ahead of Rockstar's official preview, and Take-Two is now in court seeking the identities behind the accounts sharing it. The game will still sell. The material that leaked can never be unseen. 22 Aug 2026 3 min ](/news/gta-6-leaks-rockstar-development-footage-2026)[ ![Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/nine-pbs-archives-cloud-vendor-shutdown-2026.jpg) Insight ### Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed A public broadcaster lost access to fifty terabytes of archival footage, spanning seventy years of regional history, when its cloud storage supplier suddenly went out of business. The files are still trapped in a Denver data centre. 18 Aug 2026 4 min ](/news/nine-pbs-archives-cloud-vendor-shutdown-2026)[ ![French tax authority breach exposes 678,000 taxpayers and the land registry behind them](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-tax-authority-dgfip-data-breach-2026.jpg) Insight ### French tax authority breach exposes 678,000 taxpayers and the land registry behind them France's Directorate General of Public Finances has confirmed that attackers used compromised access points to extract tax and cadastral data on 678,000 individuals and businesses. The same seller claims to have held a live session on the central land registry platform covering roughly 20 million people. 17 Aug 2026 3 min ](/news/french-tax-authority-dgfip-data-breach-678000-2026) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/how-it-works/offline-secure-storage) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)