A cyberattack on Manchester Airports Group, MAG, has exposed the personal data of about 8.7 million customers across three major UK airports.

The affected airports are Manchester Airport, London Stansted Airport and East Midlands Airport, all operated by MAG.

According to the company, hackers gained access to customer information associated with car park, lounge and fast-track bookings, as well as in-airport Wi-Fi registrations.

The compromised information included customers’ email addresses, phone numbers, postcodes and vehicle registration numbers.

MAG, however, said the affected systems did not contain customers’ bank or payment details, meaning financial information was not compromised in the incident.

The company also stressed that the cyberattack did not affect passenger safety or aviation security, while airport operations continued normally.

London Stansted Airport has warned affected customers to be cautious of unsolicited emails, telephone calls or text messages claiming to be from the airport.

The airport advised customers not to provide payment or banking information in response to unexpected communications, amid concerns that criminals could use the stolen information in phishing or other fraud attempts.

MAG said it was investigating the incident and working with relevant authorities and cybersecurity specialists to establish the full circumstances surrounding the breach.

The scale of the incident has raised concerns among cybersecurity and privacy experts because of the large volume of personal information accessed.

The affected airports handle millions of passengers annually, making the protection of customer information particularly important as more airport services, including parking, lounges, fast-track access and Wi-Fi, increasingly rely on digital platforms.

Authorities and the airport group are expected to continue investigating the breach and assess whether further customers or systems were affected.

MAG reiterated that aviation security and the safe operation of the three airports remained unaffected by the cyberattack.