Stansted Airport owner hit by cyber attack as data of 8.7 million customers stolen
Key Takeaways
- •Manchester Airport Group, which operates Stansted, East Midlands and Manchester airports, suffered a data breach affecting an estimated 8.7 million customers.
- •The stolen data included email addresses, phone numbers, vehicle registrations and postcodes, but no bank or payment details.
- •MAG discovered the breach on Tuesday, contained it, identified the hackers, and notified relevant authorities, while airport operations remained unaffected.
- •Stansted urged customers to be cautious of unexpected communications, warning that criminals may use stolen contact details for phishing scams.
- •Research from Gallagher and CEBR estimates cyber attacks cost large UK firms £11.7 billion last year, including £3.7 billion in shareholder litigation defence costs.
The owner of London Stansted Airport has been targeted in a cyber attack in which customers' data was stolen.
Manchester Airport Group (MAG), which operates Stansted, East Midlands and Manchester Airport, said on Thursday that customers' email addresses, phone numbers, vehicle registrations and postcodes had been seized in a "cyber security incident by an unauthorised third party".
The nature of the exposed data — which includes vehicle registrations and postcodes typically associated with airport parking bookings — makes the incident particularly relevant to customers who have used airport parking or booking services, although MAG has not specified which system was compromised.
"We immediately contained the risk and have been working with specialist advisors and taking appropriate steps to protect our customers and systems," the group said.
Customers notified by the company were told that the system accessed by the hackers did not hold bank or payment details. Around 8.7 million customers are believed to be affected.
In an email to customers, Stansted wrote: "We would urge you to be particularly cautious of unexpected emails, calls or text messages claiming to be from us. We will never contact you unexpectedly to ask for payment or banking information. We apologise for any inconvenience or concern this may cause."
The warning reflects a common pattern after data breaches, where criminals use stolen contact details to mount phishing campaigns impersonating the affected organisation.
MAG said it only became aware of the incident on Tuesday and moved quickly to prevent the hackers from gaining any further access. Airport operations remain "unaffected", it added.
The hackers have been identified, and relevant authorities have been informed, according to the group. Under UK data protection law, organisations must report certain personal data breaches to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of them, and the regulator has the power to issue substantial fines.
The breach comes amid mounting evidence of the financial toll of cyber crime on large UK businesses. Figures published earlier this year found that large UK businesses were forced to spend £3.7bn defending legal action brought by shareholders over cyber attacks last year.
Research from insurance giant Gallagher and the Centre for Economics and Business Research (CEBR) showed that cyber attacks cost firms with more than 250 employees an estimated £11.7bn in total. Litigation was the second-largest expense, behind a £5.4bn hit in direct losses from disrupted trading. Lost assets accounted for a further £1.3bn, while regulatory fines cost £108m.
Firms also lost £573m in costs relating to reputational damage, and nearly £400m in revenue from customers cancelling contracts, reducing spending, or switching to alternative suppliers following such incidents.
