Hackers accessed customer information linked to car parks, lounges, Fast Track bookings and airport Wi-Fi at Manchester, Stansted and East Midlands airports.

Manchester Airports Group (MAG), the operator of Manchester, London Stansted and East Midlands airports, has disclosed a major cyber security incident in which the personal data of about 8.7 million customers was accessed by an unauthorised third party.

The group said it became aware of the incident on Tuesday, August 25, although initial indications suggest the breach occurred several days earlier.

According to MAG, the compromised information relates to customers who used services including airport car parking, airport lounges, Fast Track bookings and on-airport Wi-Fi at its three airports.

The data accessed included customers’ email addresses, phone numbers, vehicle registration numbers and postcodes.

However, MAG stressed that the breach did not expose customers’ bank or payment details.

A spokesperson for the airport group said email addresses accounted for the information affected for the “vast majority” of the approximately 8.7 million customers involved.

The company said it immediately took steps to secure the affected system after discovering the incident and has brought in cyber security specialists while working with relevant authorities to investigate the breach.

Customers whose information may have been affected have been contacted by email and advised to remain vigilant against possible scams.

In its message to customers, MAG said: “We’re contacting you about a recent cyber security incident involving customer data.

“Our investigation has identified that some of your personal information relating to airport car parking, lounge, Fast Track bookings and on-airport WIFI sign-ups has been accessed by an unauthorised third party.

“Neither MAG nor the system accessed hold customers’ bank or payment details.”

The company confirmed that the information accessed included email addresses, phone numbers, vehicle registrations and postcodes.

“We took immediate action to secure the affected system and are working with cyber security specialists and the relevant authorities,” the statement added.

MAG said it takes the protection of customer information seriously and is taking appropriate measures to manage the incident and investigate how the unauthorised access occurred.

The company also sought to reassure affected customers that they do not need to take any immediate action.

However, it warned customers to be particularly cautious about unexpected emails, telephone calls or text messages claiming to be from Manchester Airports Group or any of its airports.

“We will never contact you unexpectedly to ask for payment or banking information,” the company said.

The warning comes amid growing concerns that exposed contact details could be used in phishing attempts and other forms of fraud, even where sensitive financial information has not been compromised.

Customers are therefore being urged to avoid clicking on suspicious links, opening unexpected attachments or providing passwords, payment information or other sensitive details in response to unsolicited messages.

MAG apologised to customers for any concern or inconvenience caused by the cyber security incident and said it would continue taking steps to protect affected information.

The incident adds to growing concerns over the vulnerability of major transport and travel organisations to cyberattacks, where large volumes of customer information are routinely processed through online booking and service systems.