No exploit, no phishing email, no zero-day. Just an API key that was never supposed to leave the server, sitting in a JavaScript file anyone’s browser could download.
What happened
Manchester Airports Group, the UK’s largest airport operator, confirmed on August 27 that an unauthorised third party accessed customer data across all three airports it runs: Manchester, London Stansted and East Midlands. The extortion group FulcrumSec claims responsibility and says it pulled roughly 86GB of data covering around 8.7 million customers, the largest known customer data breach involving a British airport group. The stolen material spans car park bookings, lounge bookings, Fast Track bookings and in-airport Wi-Fi sign-ups, with email addresses, phone numbers, vehicle registration numbers and postcodes among the fields, plus close to 200,000 records tied to upcoming travel later in 2026.
How they got in
FulcrumSec says the entry point was airport-specific API credentials for Iterable, MAG’s marketing platform, that were exposed directly in client-side JavaScript. That code runs in every visitor’s browser, so the credentials were retrievable by anyone who opened developer tools and looked. BleepingComputer verified samples of the data against a real traveller’s purchase history and matched Fast Track bookings, arrival times, terminal information and payment amounts. This is not a sophisticated intrusion. It is a secrets-management failure that any code review, secrets scanner, or basic frontend security check should have caught before the site ever went live.
Why this should worry every team shipping a frontend
Marketing platforms, analytics tools, chat widgets and booking systems increasingly need API access directly from the browser, and it is easy to reach for the same credential the backend uses rather than issuing a scoped, short-lived token for client-side calls. The Manchester Airports Group breach is what happens when that shortcut ships to production: a single embedded key gave an outside party access to a marketing platform holding millions of customer records, no authentication bypass required. If your organisation has ever pasted an API key into a frontend build to get a feature out the door, this is the outcome that shortcut is built for.
The GDPR angle
MAG says it detected unauthorised access on August 25 and disclosed publicly on August 27, inside the 72-hour window UK GDPR requires for notifying the Information Commissioner’s Office when a breach is likely to risk individuals’ rights and freedoms. Given the scale, 8.7 million customers, ICO engagement is close to certain. For any European organisation handling UK or EU customer data through a third-party marketing or analytics platform, this is a direct preview of what a client-side credential leak costs: mandatory regulator notification, customer trust damage, and an extortion group naming your brand on a leak site, all triggered by a mistake that a five-minute source review would have flagged.
What to check in your own stack
Audit every API key, token or credential currently shipped in your frontend JavaScript bundles, not just the ones you remember adding. Confirm that any client-side integration uses scoped, revocable, rate-limited credentials rather than a key with broad platform access. And if you don’t already run automated secrets scanning against your build output before deployment, that gap is exactly the one FulcrumSec walked through.
If you want your frontend code, build pipeline, or third-party integrations audited for exposed credentials before someone else finds them, contact Excello Digital. We help European organisations catch this class of mistake before it becomes a leak site listing.