The Airport Wi-Fi Sign-Up Held 8.7 Million People. Nobody Was Guarding It. Here Is the Lesson.

01 What actually happened

The attackers demanded a ransom. MAG refused to pay and has not disclosed the amount. It says it identified the group responsible but has not named them publicly. It notified the Information Commissioner's Office, which confirmed receipt and is assessing MAG's compliance [ Cyber Security News 2026 ] .

02 The asset nobody threat-models

Every security programme ranks its assets. The crown jewels get the budget: the payment systems, the operational technology, the customer accounts with money attached. A free Wi-Fi captive portal sits at the bottom of that list, if it appears on the list at all. It takes an email address and a tick-box consent, hands back an internet connection, and nobody loses sleep over it.

An attacker ranks the same assets differently. They are not looking for the most valuable system. They are looking for the most valuable system that is also unguarded, and a sign-up form collecting millions of records with no one watching it is the best trade in the building. Low defence, high volume. The maths is not complicated.

This is the same pattern behind most large breaches we see. The intrusion does not come through the thing security spent its money defending. It comes through the thing security decided was boring: a booking page, a supplier login, a WordPress plugin, a forgotten subdomain, a Wi-Fi form. The data does not care which system it sits in. Neither does the attacker.

03 What is not confirmed yet

Be careful with the supplier story, because it is the part everyone wants to be true. Wi-Fi captive portals, car-park payment and lounge booking are routinely outsourced to third-party vendors. Much of the coverage points that way. It is a reasonable read.

It is not confirmed. MAG has not named a third party, identified the affected system, explained how access was gained, or said when the unauthorised access began [ Business Travel News Europe 2026 ] . Anyone telling you a named supplier was breached is filling a gap the facts have not filled yet. We will not do that.

What the shape of the breach does tell you is where to look in your own estate. If the exposed data came from Wi-Fi and booking sign-ups, then the systems holding your equivalent records deserve the same scrutiny as your crown jewels, whoever runs them. A supplier breach and an in-house breach produce the same notification letter. Your customers do not read the difference, and neither does the ICO.

04 The ICO clock, and the real cost

Under UK GDPR, a personal data breach that poses a risk to people must be reported to the Information Commissioner's Office within 72 hours of the organisation becoming aware of it [ ICO 2026 ] . MAG discovered the intrusion on 25 August and the ICO has confirmed it is assessing compliance. That clock starts at discovery, which means the work of knowing what was taken, from where, and whose data it was has to happen in days, under pressure, in public.

You cannot answer those questions in 72 hours if you did not know the system existed. The organisations that report cleanly are the ones that already knew what data lived where before anything went wrong. The ones that miss the window are usually the ones discovering their own attack surface at the same time as the regulator.

05 What to test this quarter

You do not need to be an airport group to share this weakness. Every business of any size runs systems that collect personal data at the edge and get no security attention because they look trivial. Find them before someone else counts them for you.

Start with an inventory you can defend. List every external system that collects personal data, including the ones run by suppliers, and for each one write down how many records it holds and who is watching it. The systems with high record counts and no owner are your Manchester Wi-Fi portal. Then have someone test them the way an attacker would, from the outside, and report honestly what opened.

That is the work we do. We map your external attack surface, rank the doors by how easily they open and how much sits behind them, and hand you a prioritised list your board, your FCA reporting and your Cyber Essentials assessor can act on. One clear outcome, in 14 days, before an attacker does the same survey for free. Get a free audit and see exactly what an attacker reaches inside your business.