A threat group claiming responsibility for a breach of the UK’s largest airport group appears to have leaked almost all of the 550GB of data it stole online.
FulcrumSec posted the data for download on its leak site, claiming to have around 549GB of uncompressed data on MAG customers which it said was “pure PII.”
If the group’s claims are correct, the post sheds more light on the incident, which to date there has been limited information on.
It claimed that initial access was made possible after it found admin keys for customer engagement platform Iterable in the frontend JavaScript of each of the three airport’s websites.
“These keys were not found on some obscure subdomain, as was the case with the credentials that led to our breaches of Arup Group and Novo Nordisk. All three of these were on the sites’ root domain,” the note explained.
“No subdomain enumeration or URL crawling necessary; any of the millions of visitors to the site could have right-clicked ‘inspect’ and seen the keys just sitting there, plain as day. On all three websites.”
MAG manages Manchester Airport, Stansted Airport and East Midlands Airport.
Read more on MAG breach: Manchester Airports Group Hit by Cyber Incident.
The FulcrumSec post also claimed that the group obtained a much broader sweep of customer information than at first revealed by MAG.
It said it exfiltrated nearly 8.7 million customer profiles, including email, name, mobile number, home town, postcode and residential IP address. That could enable convincing follow-on phishing attacks on victims.
Also swept up in the data breach were allegedly:
- Nearly 1.2 billion marketing events including sends, opens and clicks
- Nearly 2.5 million purchases – every booking that customers of parking, Fast Track and lounges have ever made
- Over 461,000 SMS messages with passenger booking date, car park and vehicle reg in plain text
- 108,000 unique vehicle registration plates
- Platform configuration data
Physical Danger for Travellers
FulcrumSec also claimed to have data on nearly 191,000 future bookings, which includes travel schedules, PII and vehicle information that could be used by criminals to physically target holidaymakers’ homes.
It said that some of these individuals were likely public figures, politicians and military staff, judging by the email addresses associated with the bookings.
“Sadly MAG declined to pay the necessary fee to protect their passengers’ data, leaving us to remove the most sensitive parts … from the leak prior to publication,” the group added.
The group's claims have yet to be fully verified and MAG has not provided any update since its original post on August 27.