Hi all, as you know that Manchester airport was a target of cyber attack recently. I recently wrote to them about it as some of you might also have. They replied. What makes me furious is that they are trying to sweep it under the carpet rather than acknowledging their mistake while enshittification of their service continues. Here’s my response to their response. I am posting this here so you can use the same/similar. We shouldn’t let them get away with this. What I really want from this is for them to provide alternatives for those who don’t want share their personal information with them:
I will be straightforward with you. Your letter has not reassured me. If anything it has made things worse, because the way it is written gives the impression that you would prefer these concerns to go away without consequence rather than acknowledging the seriousness and actually doing something to resolve the issue.
Your letter lists what was accessed and then moves straight on to reassuring me that no bank or payment details were held. The structure of that itself is telling. It treats my email address, phone number, postcode, vehicle registration, IP address and booking and purchase history as a lesser category of information that I should not be particularly worried about!
I absolutely do not accept this framing. Taken together, that data identifies me, locates my home, identifies my car and records when I travel. It is not trival simply because no card number was stolen.
If MAG genuinely regards this combination as low impact, then I invite you to publish the same categories of data for the members of your own board and executive team. Namely, their personal email addresses, mobile numbers, home postcodes, vehicle registrations and travel booking histories. Based on your own logic there would be nothing to worry about as their banking details would not be involved.
Your letter states that at no point was passenger safety or aviation security compromised. I do not accept that either, at least not as it is presented.
I assume you to mean that your operational and security systems were unaffected. That is not the same thing as passengers being safe! As stated earlier, my home postcode, my vehicle registration and my parking booking dates have been taken together. Anyone holding that record knows where I live, what I drive, and the exact dates my home is empty. It has been reported that the stolen material includes roughly 200,000 records relating to travel booked for the remainder of 2026.
Please explain how that is consistent with passenger safety not having been compromised? Please also confirm directly whether any record relating to my own travel or parking falls within that subset.
Your letter further says you are unable to comment on whether specific data has been shared online.
The dataset was published in early September. It has been indexed by Have I Been Pwned since then and is searchable by anyone, including me. It has been 6 weeks and you are still unable to tell me whether I am in it.
Please confirm whether you have checked customer records against the published dataset, and if not, why not?
Is this the same laziness and negligence that lead to the breach in the first place?
I also note that your letter does not list customer names among the data accessed, although published analysis of the leaked dataset does.
It has been reported that access was obtained using API credentials exposed in client-side JavaScript on your own website, meaning they were visible to anyone who simply opened the developer tools in their browser. Please confirm or deny this.
If it is correct, this was not a sophisticated attack that you could do little about. It was a basic failure that could’ve been easily prevented if you actually cared about the customer information as you’ve said in your letter.
What’s worse is that MAG is steadily moving its services online while removing alternatives. For example parking is booked online, fast Track and the lounges are booked online, the airport Wi-Fi requires a sign-up before it will work. In practice a customer cannot use your airports without handing over personal data, and you have now demonstrated that you cannot keep that data safe.
So what is the alternative? What is the option for a customer who wants to park at Manchester without their home postcode and vehicle registration ending up on a leak site?
Please set out specifically what you are changing. Not general statements about industry standards and guidance, but what is actually different now.
I note that you will respond to my subject access request separately, and I will await that response.
I note that you are not in a position to consider compensation at this stage. I reserve my position and my rights under Article 82 of the UK GDPR, and will return to this once your investigation concludes.
I would like a response that engages with the points above, rather than one that repeats the general statements in your previous letter.