FulcrumSec Leaks 8.8 Million MAG Records After Exposed JS Keys Enable Breach

Manchester Airports Group confirmed a breach of a third-party database holding car park, lounge, Fast Track, and Wi-Fi sign-up records. Attackers exfiltrated names, emails, phone numbers, postcodes, vehicle registrations, 2.48 million purchase records, and 108,077 UK plates. MAG stated operations were unaffected and disclosed the incident only after the group posted the data. The initial vector cited by FulcrumSec was admin keys hardcoded in root-domain JavaScript files across Manchester, Stansted, and East Midlands sites.

The dataset added to HaveIBeenPwned shows 8.8 million unique emails and phones plus browser agents and residential IPs. MAG’s reliance on a single third-party host for booking data created a single point of failure with no apparent segmentation or key rotation. Public exposure of credentials in client-side code repeats a pattern seen in prior transport-sector incidents where frontend misconfigurations bypassed perimeter controls.

No independent technical attribution links FulcrumSec to a state actor; the group’s claims rest on data volume and internal configuration files. Travelers face heightened phishing and SIM-swap risk from exposed contact data and vehicle plates. Expect UK ICO enforcement notices and class-action filings within 90 days as affected individuals receive breach notifications.

Regulatory pressure will force MAG to audit all third-party data processors and remove any remaining static keys from public assets. Similar exposed-credential patterns at other UK transport operators suggest the issue is systemic rather than isolated.