Target: Manchester Airports Group (Manchester, London Stansted, East Midlands)
Date: August 2026
Threat Actor: FulcrumSec
Attack Vector: Exposed API Credentials in Frontend JavaScript
Impact: Exfiltration and leak of 8.8 million customer records (~86 GB compressed / ~640 GB raw data)
The Crack
Hardcoded Admin Keys in Client-Side Code
Modern web applications often rely on third-party marketing and platform tools via APIs. When API admin credentials or secrets are inadvertently embedded into public-facing frontend JavaScript code, anyone inspecting the site can extract high-privilege access tokens without needing to bypass complex perimeter firewalls and the only tools are by pressing F12 in their browser and using developer tools.
The Execution
- Credential Reconnaissance: Attackers didn’t need to brute-force a login portal or bypass sophisticated perimeter firewalls. They simply scraped the root web domains of MAG’s regional airport sites (Manchester, London Stansted, and East Midlands) and harvested those hardcoded administrative API keys straight out of the public JavaScript bundles.
- Direct Platform Exploitation: Armed with high-privilege keys tied to platforms like Iterable, the threat actor bypassed application-level controls entirely. They used those legitimate admin credentials to directly query backend marketing databases and booking repositories, acting as an authorized entity from the application’s perspective.
- Bulk Data Exfiltration: With open access to the core repositories, the actors pulled a staggering 86 GB of compressed database exports—translating to roughly 640 GB of raw data. This haul included deep customer profiles, historical parking bookings, lounge reservations, Fast Track purchases, vehicle registration plates, and airport Wi-Fi registration logs.
- Ransom & Leak Extortion: MAG caught the unauthorized access and refused to play ball with ransom demands. True to form, the extortion group FulcrumSec retaliated by dumping the entire stolen dataset—all 8.8 million customer records—straight onto their dark web leak site for anyone to download.
The Blast Radius
- Mass PII Exposure: 8.8 million unique customers had personal details—including email addresses, phone numbers, vehicle license plates, postcodes, and past travel itineraries—exposed online.
- Heightened Phishing Risk: Exposed travel schedules and purchase records leave affected passengers heavily vulnerable to highly convincing, targeted phishing and fraud campaigns impersonating airport services.
- Hyper-Targeted Phishing: With deep visibility into specific purchases (such as lounge access, Fast Track, and parking), threat actors have all the context they need to run hyper-convincing, highly targeted spear-phishing campaigns impersonating airport services or travel partners.
- Operational Resilience vs. Data Spill: While core airport infrastructure, flight safety systems, and air traffic control remained entirely uncompromised, the fallout forced MAG to temporarily yank public-facing tools like the “Manage My Booking” portal offline to lock down systems.
The Hardening Plan
- The Secret Management Reality Check: Stop treating client-side code as a secure vault. Never embed high-privilege API keys, administrative tokens, or private secrets directly within frontend JavaScript. Route all third-party API interactions through secure backend servers that completely isolate credentials away from the browser DOM.
- Automated Client-Side Code Scans: Integrating traditional Static Application Security Testing (SAST) into your repository isn’t enough. You need automated secret-scanning tools built directly into your CI/CD pipelines to inspect the compiled and deployed production bundles that actually get pushed to users, intercepting exposed keys before they ever hit the wild.
- Enforce Least-Privilege API Scope: Never hand out blanket admin keys when a scoped token will do. Ensure third-party API integrations—like marketing platforms or customer engagement tools—are locked down tightly to perform only necessary, low-privilege actions rather than granting full read/write access to central customer databases.