A Breach That Allegedly Started With a Right-Click
Manchester Airports Group, which runs Manchester, Stansted and East Midlands airports, disclosed on August 27, 2026 that a database hosted by a third party had been compromised. An extortion group calling itself FulcrumSec claimed responsibility over the following days and began publishing the stolen data on its leak site in early September, saying it holds up to 8.7 million customer records.
The claimed method of entry is the part of this story that should worry more businesses than the headline number does. According to reporting from the trade outlet teiss, FulcrumSec says it used Manchester Airport-specific credentials for Iterable, a marketing automation platform, that were exposed in client-side JavaScript, the code that runs in a visitor's own browser and can be inspected by anyone who opens developer tools and looks. MAG has not confirmed this account of how access was gained, and has said only that it is working with specialist advisors, so the vector itself remains an allegation rather than a settled fact.
What Was Reportedly Taken, and What MAG Says Was Not
The data FulcrumSec claims to hold includes email addresses, phone numbers, postcodes and vehicle registrations tied to car park, lounge and Fast Track bookings, along with sign-ups from in-airport Wi-Fi, and close to 200,000 records covering upcoming travel for the remainder of 2026, complete with dates, times and booking details. SecurityWeek reports the group put the volume at roughly 86 gigabytes.
MAG's own public statement is narrower and more cautious than the extortion group's claims: the company says the affected systems did not hold bank or payment details, that airport operations and car park services continued running normally throughout, and that it received a ransom demand it has declined to detail further, including whether any payment was made. That gap between an attacker's boast and a company's confirmed facts is normal in a live extortion case, and it is exactly why the vector matters more than the headline count until MAG says otherwise.
The Claim Against the Confirmation
| Detail | FulcrumSec's claim | MAG's public statement |
|---|---|---|
| Records affected | up to 8.7 million | not officially confirmed |
| Data volume | about 86 gigabytes | not confirmed |
| Attack vector | Iterable API key exposed in frontend JavaScript | not confirmed |
| Bank or payment data | not claimed to be included | confirmed not exposed |
| Ransom paid | not stated | demand received, no further detail given |
Whatever the final, confirmed numbers turn out to be, the vulnerability class FulcrumSec describes is common and rarely audited: a marketing or analytics tool that needs a snippet of JavaScript running on every page will often ship with an API key baked directly into that snippet, because it is the fastest way for a marketing team to get a campaign live. If that key is a full-access credential rather than one scoped to a narrow, write-only, public-safe permission, anyone who views the page's source code holds the same key the marketing team uses internally.
What This Means for Any Business Running a Marketing Tool
The practical test costs nothing and takes minutes: open a browser's developer tools on your own public-facing pages, search the loaded scripts for the word 'key' or 'token', and check with whichever vendor issued it, Iterable or otherwise, whether that credential is scoped for public client-side use or whether it is the same key that controls the account. Most marketing platforms offer a public, write-restricted key specifically for this purpose, and the fix is usually a support ticket, not a rebuild.
The harder fix is organisational rather than technical: marketing and growth tooling is frequently added to a website by a team that owns the campaign, not the codebase, and it rarely passes through the same security review as a login page or a payment form. A quarterly check of exactly what credentials sit in a site's public JavaScript, owned jointly by IT and marketing rather than assumed to be someone else's job, would have caught exactly the exposure FulcrumSec says it found.
Servola Journal
We do this for everyone trying to keep up with what technology is doing to our lives. The people who build it, and the people it happens to. The Servola Journal exists so that what we learn belongs to all of them.
Nobody pays us for this. No ads, no paywall, free to everyone. We just believe that understanding what's happening to all of us shouldn't depend on who can afford to pay for it.
If it gave you something today, tell us to keep going. Follow us, leave a like, or write a positive comment. We read every one, and they are what keeps us going.
Read next: 8.7 Million Airport Records Leaked in One Breach | France Just Priced Missing MFA at EUR 500,000
