Crooks Behind Manchester Airports Group Hack Leaks Data of 8.8 Million People
What Happened – Attackers claiming to be the extortion group FulcrumSec released a half‑terabyte dump containing email addresses, phone numbers, vehicle registrations and postcodes for 8.8 million passengers of Manchester, London Stansted and East Midlands airports. The breach originated from administrator keys that were hard‑coded in the client‑side JavaScript of each airport’s public website, giving the attackers unrestricted read access to a third‑party booking database.
Why It Matters for Trust & Control Assurance
- This incident is a textbook example of a secret‑management failure that a continuous control‑assurance program must detect, document and remediate.
- Demonstrating that secrets are never exposed in client‑side code, and that key rotation and access reviews are continuously monitored, provides the audit‑ready evidence required by multiple frameworks.
- Verisq’s Control Mapping capability can automatically surface such configuration gaps across your web assets and supply the defensible evidence needed for regulators and auditors.
Who Is Affected – Aviation operators, airport‑service vendors, travel‑booking platforms, and any organization that stores passenger PII in web‑exposed services.
Recommended Actions
- Conduct an immediate secret‑scanning of all public‑facing code repositories and web assets.
- Rotate any exposed keys, enforce least‑privilege API access, and implement automated alerts for future secret leaks.
- Update third‑party risk assessments to include secret‑management controls and collect evidence for audit readiness.
Technical Notes – The attackers leveraged hard‑coded admin API keys embedded in JavaScript (a classic client‑side secret exposure). No payment‑card data were taken, but the combination of PII and vehicle details creates a high fraud risk. Source: SecurityAffairs