Hackers behind the breaches at Manchester, London Stansted, and East Midlands airports have reportedly published all 8.7 million records they stole from their operator, the Manchester Airports Group (MAG).

The attackers say some of the stolen records belong to public figures, politicians, and military personnel, warning this could expose victims to burglary, stalking, and other physical threats.

“A quantity of customer data was obtained by an unauthorised third party. Neither MAG nor the system accessed hold customers’ bank or payment details. The data that has been accessed includes customers’ email addresses, phone numbers, vehicle registrations and postcodes,” MAG stated on its website.

A MAG spokesperson told the BBC on Monday that hackers had demanded a ransom fee for the return of the data, but this was refused by the airport group. As per Wednesday’s BBC report, criminals have published all the data they stole from the airports’ operator.

"Today we are releasing the Manchester Group database," hackers said. "Half a terabyte, and every byte of it is pure PII [personally identifiable information]."

In the dark web post, the group has claimed that the stolen material includes:

• 8,672,291 customer profiles
• 1.169 billion marketing events,
• 2,482,763 purchases
• 461,433 SMS messages
• 108,077 vehicle registrations
• Platform configuration data
• Future booking information

MAG, the UK's largest airport operator, disclosed the cyberattack on August 27th, revealing that data from approximately 8.7 million customers was accessed. This included information collected through WiFi registrations and car park, lounge, and Fast Track bookings.

The operator said that no bank or payment information was held on the affected systems and that passenger safety and airport operations had not been compromised.

MAG also stated that the "vast majority" of the 8.7 million affected customers had only their email addresses exposed – which still makes it one of the biggest airport breaches in the UK.

The attackers claimed that it wasn’t a challenge to steal this valuable data.

These [security]keys were not found on some obscure subdomain; any millions of visitors to the site could have right clicked ‘inspect’ and seen the keys just sitting there, plain as day,

Threat actor FulcrumSec claims it was simple it was to steal data from MAG.

“All 3 of these were on the site’s root domain. No subdomain enumeration or URL crawling necessary," the criminal group added.

FulcrumSec separately said: “Sadly MAG declined to pay the necessary fee to protect their passenger’s data, leaving us to remove the most sensitive parts… from the leak prior to publication.”

Who is FulcrumSec?

Fulcrumsec is a financially motivated data-extortion group that specializes in stealing sensitive corporate information and then threatening to publish it.

The threat actor has previously claimed attacks against Ozempic maker Novo Nordisk and legal data giant LexisNexis.

The group claimed it spent more than 2 months inside Novo Nordisk’s network before allegedly exfiltrating around 1.3TB of data, including information relating to clinical trials, drug development, source code, employees, and AI assets.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, said the hackers published the records after their ransom demand was rejected to send a message to other potential victims.

The "free release" model is deliberately designed to maximize harm and reputational damage as a warning to the next target,"

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.

“Publishing almost 9 million records for free isn't just punishment for MAG, it's a marketing campaign aimed at every other organisation watching. Pay up, or your customers' data gets handed to every fraudster and scammer on the internet at no cost.

“ Refusing to pay a ransom is the right call. But nearly 9 million people are now paying a different price for a decision that was never theirs to make," Patel added.