Customers of Manchester, Stanstead and East Midlands Airports have had their data leaked in a serious breach.
In August 2026, Manchester Airport Group (MAG), the company behind Manchester, Stanstead and East Midlands Airport, alerted customers to a cyber security incident.
The hackers have reportedly held this data for ransom, demanding an undisclosed amount for the return of the data.
An unauthorised third party had been able to access the personal information of 8.7 million customers that had used airport parking, in airport Wi-Fi, lounge access or fast track bookings in all three of the companies’ airports.
The accessed data included:
KP Law has launched an investigation and group action to find out what happened and how this breach affects MAG customers.
Our data breach group action will help affected customers in England & Wales claim compensation for the security failures.
A spokesperson from MAG has stated that the company became aware of the data breach on Tuesday 25th August, and alerted customers two days later, Thursday 27th August. MAG said in a statement that they have taken the appropriate steps to alert the relevant authorities, and they did not store customer bank or payment information.
However, with the nature of the information leaked, customers remain at a very high risk of cyberattacks, fraud and identity theft.
Our Process
KP Law specialises in complex, multi-claimant litigation. We investigate the underlying circumstances of each case, assess the available evidence and work with leading legal and technical experts where appropriate.
For data breach claims, this can include examining:
Where appropriate, we coordinate claims collectively so that common legal and factual issues can be considered efficiently, while ensuring that individual circumstances are taken into account.
8.7 million people may have been affected where personal information held by Manchester Airport Group was accessed without authorisation.
If you received a breach notification or you believe you were affected by the MAG data breach, you can sign up using the link below.
Exposed personal information from data breach incidents increases the risk of identity theft and phishing emails and scams.
Under GDPR, companies that gather or hold personal data have a responsibility to their customers to protect that information from unauthorised third parties. Group litigation can ensure consumers are adequately compensated for the damages caused, and that corporates can be held accountable for data privacy breaches.
Register your details in less than 2 minutes
Pay nothing unless your claim is successful
Join thousands of others seeking justice
Take action now – don’t let Manchester Airport Group's failure go unanswered.
If you believe your data may have been accessed, you should follow the below steps to protect yourself from further harm:
Change your login details on your accounts and use strong, unique passwords. Customers were also advised to change passwords and enable two-factor authentication (2FA) at the same time as a precautionary measure.
Stay alert for suspicious calls, texts or emails. Whilst the breach included limited betting account information and recent activity on accounts, there's still a risk that even limited personal information could be used in phishing scams.
Be aware of any unexpected activity on your accounts - consider getting a copy if your credit file to check for identity misuse after the breach.
Learn how to stay safe following a data breach:
While each case is judged on its own merits, there are some things we would typically look for when it comes to when claiming compensation following a data breach, cybercrime or other GDPR violation:
Financial loss
With stolen data, cybercriminals can make purchases using your bank and credit cards, apply for credit in your name, set up fraudulent bank accounts and access your existing online accounts.
Distress
GDPR failures, cybercrime and data breaches can have a significant impact on you, both mentally and physically. They can cause or exacerbate anxiety, stress and other psychological conditions.
Loss of privacy
Your questions answered
See our answers to the FAQs we get asked about the MAG Data Breach.
Manchester Airport Group is the company that own and operate Manchester Airport, Stanstead Airport and East Midlands Airport. They are the largest airport group in the UK and handle millions of customers every year.
A serious cyber breach was detected at the company in August 2026. Hackers accessed the information of 8.7 million customers and held it to ransom. The information included names, phone numbers, email addresses, phone numbers, vehicle registrations and postcodes. MAG alerted customers shortly after the breach was detected.
MAG will have sent out a notification to any customers affected by the breach.
Anyone who thinks they might be involved should take immediate steps to protect themselves. Find out how to do this here.
If you receive notification that you are affected by the MAG data breach, register to receive updates on our investigation. We’ll let you know what’s happening, and if and when you can make a data breach compensation claim.
A group action claim is where a group of people – sometimes even thousands of people – have been affected by the same issue. Group action cases are also known as class actions, multi-claimant, or multi-party actions.
There are no costs to join our claim. However, if your claim is successful, you may have to pay a ‘success fee’. This fee is taken from the compensation awarded to you. At KP Law, our success fee is competitive, and we make sure you are fully informed about any potential costs before you officially join our action. If you lose, you won’t have to pay a penny.
