FulcrumSec Strikes Manchester Airports Group: 86GB Stolen Via Exposed API Credentials in Browser Code

In a dramatic escalation of the recent UK travel sector turmoil, the extortion group FulcrumSec has claimed responsibility for a massive data breach at Manchester Airports Group (MAG), alleging the theft of a staggering 86GB of data from its servers. The group claims the intrusion was accomplished not through complex malware, but by leveraging API credentials left exposed in client-side JavaScript—code that runs directly in the browsers of unsuspecting visitors. This hacking incident, which affects operations at Manchester, London Stansted, and East Midlands airports, highlights a dangerous and often overlooked vulnerability in modern web application security.

While MAG officially disclosed a data breach on August 27 affecting millions of customers, the extortion group’s claims suggest the scope of the cybersecurity incident is far more severe and detailed than initially reported. By finding hardcoded API keys for the marketing platform Iterable within the website’s JavaScript, FulcrumSec allegedly bypassed security perimeters with relative ease, grabbing personal identifiers, historical booking details, and even information regarding upcoming travel plans stretching into 2026. As the group prepares to publish the stolen database, travelers are being urged to remain vigilant against highly targeted phishing attacks that could exploit this sensitive travel data.

The Initial Disclosure vs. The Extortionist’s Claim

Manchester Airports Group first alerted the public to a data breach on August 27, describing an incident affecting customers across its three major hubs. The official statement outlined a relatively contained exposure, concerning car park bookings, lounge access, Fast Track security passes, and airport WiFi registrations. According to MAG, the compromised data included email addresses, phone numbers, vehicle registrations, and postcodes. Although the company acknowledged that the breach impacted a substantial 8.7 million customers, they were quick to clarify that the majority of those individuals had only their email addresses exposed, downplaying the immediate risk of financial fraud.

However, the narrative took a more sinister turn just two days later when BleepingComputer reported that the extortion group FulcrumSec had stepped forward to claim credit for the attack. The group’s description of the stolen data paints a picture of a far more comprehensive haul. FulcrumSec alleges they exfiltrated roughly 86GB of data—a volume that dwarfs the limited dataset MAG initially described. To substantiate their claims, the threat actors shared samples with BleepingComputer, which included a massive 21.5GB export specifically containing Manchester customer data. These files reportedly contained personal identifiers, historical booking details, and internal marketing information that should never have been accessible to an external threat actor.

The Vulnerability: Exposed API Credentials in Client-Side Code

The most alarming aspect of this hacking incident is not just the volume of data stolen, but the method of intrusion. FulcrumSec claims they gained access to MAG’s systems by discovering airport-specific Iterable API credentials embedded directly within client-side JavaScript. For those unfamiliar with web development, client-side JavaScript is code that is downloaded and executed within a user’s browser to create interactive features. This inherently means the source code is visible to anyone who knows how to use browser developer tools, inspect the network traffic, or simply view the page source.

Leaving API credentials in this environment is widely considered a critical cybersecurity vulnerability. These credentials act as keys to backend services, and when exposed, they allow attackers to query or manipulate the data held by the third-party platform. In this case, the keys were for Iterable, a marketing platform utilized by the airports to manage customer communication and engagement. "The group claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript and that the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026," states the report. If this is accurate, the attackers did not need to deploy sophisticated malware or exploit a complex server flaw; they simply found the keys to the kingdom left on the front porch.

What Was Actually Stolen?

Independent verification of the full extent of the theft is ongoing, but BleepingComputer managed to cross-reference a sample record provided by FulcrumSec against a real traveler’s purchase history. The findings were chillingly accurate, revealing matching Fast Track bookings, specific arrival times, terminal information, and exact payment amounts. This confirmation serves as a stark warning that the extortion group’s claims are not merely bluffing.

Beyond the historical booking data, the most concerning specific claim is the nearly 200,000 records tied to upcoming travel through the rest of 2026. These records allegedly contain specific dates, times, and booking references linked directly to personally identifiable information (PII). This combination of data is a goldmine for cybercriminals. While BleepingComputer could not independently verify this specific number or the total scope of the exfiltration, the correlation of the sample data lends significant weight to FulcrumSec's narrative. When contacted for comment, MAG did not directly address the extortion group’s claims, instead pointing to their existing statement and asserting that "MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected."

The United Kingdom Factor: The Danger of Postcodes

Security researchers analyzing the broader incident have highlighted a unique risk specific to the UK landscape: the precision of UK postcodes. Unlike American ZIP codes, which often cover large, sprawling delivery areas, a full UK postcode typically identifies a very small cluster of neighboring addresses—sometimes even a single office or residential property. The Office for National Statistics notes that this granularity allows for exact geolocation targeting.

When combined with vehicle registrations, parking dates, and specific booking references, the stolen data provides more than enough raw material for highly convincing phishing messages. An attacker could easily craft an email referencing a real upcoming trip to the airport, complete with the traveler’s car license plate and the terminal they are flying from. For an unsuspecting victim, such a message would be almost impossible to distinguish from a genuine MAG communication. This potential for "real-world harm" is reportedly the reason FulcrumSec may redact certain upcoming travel records when they eventually publish the stolen database, as they have threatened to do, alongside a technical account of the intrusion.

Supply Chain Risks and A Bad Year for Aviation

This incident shines a harsh light on the supply-chain vulnerabilities plaguing the aviation sector. Airport operations are increasingly run through third-party platforms for booking, parking, and loyalty services, rather than systems the airport itself directly controls. The Iterable API is a prime example of this outsourced dependency. When a third-party vendor’s integration is misconfigured or its credentials are exposed, the primary brand—in this case, MAG—bears the reputational damage and the legal responsibility for the data breach.

This is not the first major cybersecurity setback for aviation infrastructure in recent months. A September 2025 ransomware attack on Collins Aerospace’s check-in software caused massive groundings and operational chaos at major hubs like Heathrow, Brussels, and Berlin. With these two incidents occurring within a twelve-month window, it is clear that UK and European aviation infrastructure is under significant siege from cybercriminals, ranging from ransomware gangs to extortion groups like FulcrumSec.

Conclusion

While Manchester Airports Group assures the public that no payment card or banking data was exposed, the theft of PII, vehicle registrations, and specific travel itineraries represents a severe threat to customer privacy and security. The alleged method of intrusion—using client-side JavaScript to find exposed API credentials—reinforces that robust cybersecurity requires more than just strong firewalls; it requires developers to treat all client-side code as publicly accessible. Travelers who recently booked parking, lounge access, or Fast Track services at Manchester, London Stansted, or East Midlands should assume their travel data may be in the hands of malicious actors. Moving forward, it is imperative to treat any message citing real booking details with extreme caution, verify requests through official channels, and monitor communications for signs of phishing attempts leveraging this stolen data. The full fallout of the FulcrumSec breach remains to be seen, but it serves as a critical lesson in the importance of securing every link in the development chain.