A cyberattack affecting Manchester, London Stansted and East Midlands airports has reportedly exposed information relating to around 8.7 million customers, highlighting how significant data-security incidents can occur without causing an obvious interruption to business operations.

Manchester Airports Group (MAG), which operates all three airports, confirmed that an unauthorised third party obtained customer information relating to car park, lounge and Fast Track bookings, as well as in-airport Wi-Fi registrations.

The information accessed included email addresses, phone numbers, vehicle registration numbers and postcodes. MAG has said that neither it nor the system affected held customers' bank or payment details.

Crucially, airport operations continued as normal and MAG said passenger safety and aviation security were not compromised.

For UK organisations, the incident demonstrates why cyber resilience needs to extend beyond preventing operational shutdown. An attack can expose valuable information and create significant risks even when systems continue functioning.

What Happened in the Manchester Airports Group Cyberattack?

Manchester Airports Group confirmed the cyber-security incident after an unauthorised third party accessed customer information associated with Manchester Airport, London Stansted Airport and East Midlands Airport.

According to MAG, the affected information related to:

Airport Wi-Fi registrations.
Car park bookings.
Lounge bookings.
Fast Track bookings.

The information obtained included customer email addresses, telephone numbers, vehicle registrations and postcodes.

MAG said it immediately took action to contain the incident, restricted access to affected systems, engaged cyber-security specialists and notified the relevant authorities.

The group also temporarily suspended access to its online Manage My Booking service as a precaution.

Importantly, the incident did not affect operational airport systems. Flights, airport operations and customer parking services continued to function.

That distinction provides an important lesson for businesses assessing cyber risk.

A damaging cyber incident does not have to involve an organisation's most critical operational systems.

Data Exposure Can Be Serious Without Operational Disruption

Cyberattacks are often discussed in terms of ransomware, system outages or organisations being unable to operate.

Those are serious risks, but they represent only part of the cyber-threat landscape.

An attacker who gains access to customer information may create significant consequences without taking systems offline.

Potential impacts can include:

Exposure of personal information.
Regulatory and data-protection concerns.
Increased phishing and impersonation risks.
Reputational damage.
Customer notifications and support requirements.
Incident-response and forensic costs.
Further attacks using compromised information.

This is why businesses should consider both availability and confidentiality when assessing their cyber-security arrangements.

A system may remain available while the information within it has nevertheless been accessed or extracted.

Conflict International's Cyber Security and Incident Response Services support organisations dealing with suspected data exposure, account compromise and other digital-security incidents.

Why Apparently Limited Data Can Still Be Valuable to Criminals

The MAG incident also demonstrates why organisations should not dismiss information simply because it does not include payment-card or banking details.

Email addresses, telephone numbers, postcodes and other identifying information can still have value to criminals.

When several pieces of information are combined, they can help make subsequent fraudulent communications appear more convincing.

For example, a criminal who knows that an individual has interacted with a particular airport or travel service may be able to construct a targeted message relating to:

A booking.
Parking.
Airport lounges.
Fast Track services.
Travel disruption.
Refunds.
Account verification.

The objective may then be to persuade the recipient to disclose credentials, provide payment information or follow a malicious link.

Following the incident, customers were specifically warned to remain cautious about unexpected emails, telephone calls and text messages.

For businesses, the lesson is that assessing the seriousness of a breach should involve understanding how exposed information could realistically be used, not simply whether financial data was present.

Businesses Need to Understand Where Customer Data Is Held

Modern organisations can accumulate customer information through far more channels than their main transactional systems.

Examples can include:

Public Wi-Fi registration.
Customer portals.
Marketing platforms.
Booking systems.
Mobile applications.
Loyalty programmes.
Customer-support systems.
Event registrations.
Third-party service providers.

Some datasets may initially appear low-risk because they contain relatively limited information.

Over time, however, information can accumulate across multiple platforms and services.

Businesses therefore need a clear understanding of what data they hold, where it is stored, who can access it and how long it is retained.

Data minimisation can also reduce the potential impact of an incident. Information that no longer serves a legitimate operational, legal or business purpose should not necessarily remain accessible indefinitely.

Incident Response Is About More Than Restoring Systems

The response to a suspected cyberattack needs to establish what actually happened.

Restoring normal operation is important, but it does not necessarily answer whether an attacker gained access to information before the incident was contained.

A structured cyber-incident response may need to determine:

Which systems were affected.
When unauthorised access began.
How access was obtained.
Which accounts or credentials were compromised.
What information could be accessed.
Whether data was copied or removed.
Whether persistence mechanisms remain.
Whether other systems may also have been affected.

Preserving relevant evidence can be particularly important.

Logs, authentication records, endpoint information, emails and other digital evidence may help establish the sequence of events and inform decisions about containment, remediation and notification.

Conflict International's Cyber Security and Incident Response Services can assist organisations in understanding the scope of a suspected compromise and identifying appropriate next steps.

Customer Communication Matters After a Data Breach

Organisations also need to consider what happens after affected individuals are informed.

A genuine breach notification can itself create an opportunity for criminals.

Customers who know that their information has been exposed may expect further communication from the affected organisation. Fraudsters can exploit that expectation by sending convincing follow-up messages pretending to offer assistance, refunds or security updates.

Businesses responding to an incident should therefore make clear:

What information has been affected.
What information has not been affected, where known.
Whether customers need to take any action.
How genuine communications will be sent.
What the organisation will never ask customers to provide.
Where customers can verify information independently.

Clear communication can reduce uncertainty and make impersonation attempts easier to recognise.

What Should UK Businesses Learn From the Airport Cyberattack?

The scale of the Manchester Airports Group incident makes it particularly visible, but the underlying issues apply to organisations of all sizes.

Businesses should consider whether they can answer some fundamental questions before an incident occurs:

Do we know exactly what customer information we hold?
Which systems contain the most sensitive information?
Who has access to those systems?
Are access permissions regularly reviewed?
Are unusual account and network activities detectable?
Do we retain sufficient logs to investigate an incident?
Do we have a documented cyber-incident response plan?
Do employees know how to escalate suspicious activity?
Do we understand the risks created by third-party systems?
Could we quickly establish what information had been affected?

Cyber security is therefore not simply about blocking attacks.

It also involves limiting the information and systems that can be reached, identifying suspicious activity quickly and having the evidence and procedures necessary to respond when preventive controls do not succeed.

The Manchester Airports Group incident is a reminder that an organisation can remain operational while still facing a significant information-security event.

For businesses holding customer, employee, financial, legal or commercially sensitive information, preparation can determine how quickly an incident is contained and how accurately its consequences can be understood.

Conflict International provides Cyber Security and Incident Response Services to businesses, organisations and legal teams requiring assistance with cyber incidents, data exposure, account compromise and digital-security risks.