Hackers have published the personal data of about 8.7 million Manchester Airports Group customers after the operator refused to pay a ransom, the BBC reported on Sept. 2. MAG runs Manchester, London Stansted and East Midlands airports. Customers of all three are being warned to expect follow-on scams now that the data is available to other criminals.
“Today we are releasing the Manchester Group database,” the group wrote. “Half a terabyte, and every byte of it is pure PII [personally identifiable information].” TechRadar and Cybernews named the group as FulcrumSec, which has claimed responsibility. The BBC said the leak site is on the open web rather than the dark web, which makes the data easier to get.
What was taken
MAG disclosed the breach on Aug. 27. It said the exposed data includes email addresses, phone numbers, vehicle registrations and postcodes collected through Wi-Fi registrations and car park, lounge and Fast Track bookings. The company said its systems held no bank or payment details, that the “vast majority” of affected customers had only an email address exposed, and that passenger safety and airport operations weren’t affected.
FulcrumSec’s post claims more, according to Cybernews: 8,672,291 customer profiles, 1.169 billion marketing events, 2,482,763 purchases, 461,433 SMS messages, 108,077 vehicle registrations, platform configuration data and future booking information. HaveIBeenPwned analyzed the published material and confirmed it contains email addresses, phone numbers, addresses, license plate numbers, purchase history and browsing device data, the BBC said.
The group claimed the break-in was easy. It said security keys were exposed on the airports’ root domain, where “any millions of visitors to the site could have right clicked ‘inspect’ and seen the keys just sitting there.” The BBC said the hackers described using the same method, weaknesses in how companies store keys for internal networks, against every victim it posted. Cybernews said FulcrumSec has also claimed attacks on Novo Nordisk and LexisNexis.
Phishing risk
“The data includes both historical locations and planned future travel, so individuals sensitive to their movements being known may need to take precautions,” security researcher Kevin Beaumont told the BBC. David Sancho, a senior threat researcher at TrendAI, told TechRadar that customers should be suspicious of messages that mention “upcoming trips, parking, Fast Track, lounges, refunds, booking changes or payment problems.” He said they should open their bookings through the official airport website rather than links in messages.
MAG said it has contacted everyone affected, including customers with upcoming bookings, and is working with the authorities. “MAG is confident that we have taken effective measures to protect our customers,” the company said.
WebProNews is an iEntry Publication