Nearly nine million holidaymakers’ data was stolen after a ‘sophisticated’ cyber-attack on three UK airports, it emerged today.
An extortion group behind the attack demanded ‘a ransom’ of several million pounds after seizing email addresses, phone numbers, vehicle registrations and postcodes from travellers who used Manchester, Stansted and East Midlands airports.
The attackers contacted Manchester Airport Group (MAG), which owns the three hubs, on Tuesday setting a deadline of 48 hours for payment if it wanted the data returned. It is understood the amount demanded was below £5million.
But MAG bosses refused, meaning the extortion group is now free to sell the data to the highest bidder.
The attack, which happened at the weekend, has been reported to the National Cyber Security Centre (NCSC), part of the intelligence and security agency GCHQ, and watchdog the Information Commissioner’s Office.
While links to hostile foreign states haven't been fully ruled out, investigators believe the attack was mainly about extorting money.
It is understood the amount demanded is considered low when compared with other cyber-attacks, which investigators believe is because the majority of the data stolen was just email addresses.
Travellers who have used Stansted airport were among those to have their data stolen in the cyber attack
Insiders said the attack appeared to be ‘sophisticated’ because it was not as simple as a staff member opening a ‘phishing’ email or other form of electronic communication. The ransom note sent by email on Tuesday was also written in the style of a ‘legitimate business’ and the extortion group has been linked to hacks on other UK and global organisations.
MAG insisted no bank or payment details were stolen and that ‘at no point’ were passengers put in danger.
It also said flights were taking off as normal and that holidaymakers shouldn’t change their plans.
But it is a major breach and will hugely concern the roughly 8.7 million passengers who had their details stolen.
The data was held on systems related to passengers who have used airport car parks, lounges, logged into airport Wi-Fi and used fast-track passes.
Beverley Griffiths, senior lecturer in security and resilience at Buckinghamshire New University, said: ‘While email addresses, phone numbers, postcodes and vehicle registration details may appear less sensitive than financial data, large volumes of this information can be highly valuable to cyber criminals.
‘Combined, these details can be used to build profiles of individuals and support targeted phishing, social engineering and fraud attempts.’
Lauren Wills-Dixon, partner and head of privacy at law firm Gordons, said: 'The scale of this attack is notable.
‘This is another reminder of the importance for organisations to take legal, regulatory and best practice measures to build and maintain cyber resilience.’
More than 32 million passengers flew into or out of Manchester Airport last year, while more than 30 million travelled through Stansted, in Essex, and four million through East Midlands in Leicestershire.
An NCSC spokesman said: ‘We are working with Manchester Airports Group in response to a cyber incident.
‘The NCSC encourages anyone who thinks they may have been the victim of a data breach to be especially vigilant against suspicious emails, phone calls, or text messages and to follow the steps set out in our data breaches guidance.’
A MAG spokesman said: ‘A quantity of customer data has been obtained that relates to car park, lounge and fast track bookings and in-airport wifi sign-ups at Manchester, Stansted and East Midlands airports.
‘We immediately contained the risk and have been working with specialist advisers and taking appropriate steps to protect our customers and systems.
‘At no point has passenger safety or aviation security been compromised.
‘The incident has not resulted in any operational disruption. Airport operations remain unaffected and customer parking services continue to operate normally.’