FulcrumSec Claims Responsibility for Manchester Airport Group Breach
FulcrumSec leaked ~549GB of Manchester Airport Group data, claiming 8.7M customer profiles exposed via exposed Iterable admin keys.
FulcrumSec posted around 549GB of uncompressed stolen Manchester Airport Group (MAG) data on its leak site, claiming nearly 8.7 million customer profiles with email, name, phone, home town, postcode and residential IP. The group said initial access came from Iterable platform admin keys exposed in the root-domain JavaScript of the Manchester, Stansted and East Midlands airport websites. Allegedly stolen data also includes ~1.2 billion marketing events, 2.5 million bookings, 461,000 SMS records, 108,000 vehicle plates and ~191,000 future bookings. MAG has provided no update since August 27 and the claims remain unverified.
- Admin keys sat in site root-domain JavaScript, visible to any visitor via dev tools
- Data could enable convincing phishing and physical targeting of future travelers, possibly including officials
- Group says MAG declined to pay a fee, and sensitive portions were removed before publication
- Follows earlier FulcrumSec breaches of Arup Group and Novo Nordisk
Full article428 words · extracted from infosecurity-magazine.com · click to collapse
A threat group claiming responsibility for a breach of the UK’s largest airport group appears to have leaked almost all of the 550GB of data it stole online.
FulcrumSec posted the data for download on its leak site, claiming to have around 549GB of uncompressed data on MAG customers which it said was “pure PII.”
If the group’s claims are correct, the post sheds more light on the incident, which to date there has been limited information on.
It claimed that initial access was made possible after it found admin keys for customer engagement platform Iterable in the frontend JavaScript of each of the three airport’s websites.
“These keys were not found on some obscure subdomain, as was the case with the credentials that led to our breaches of Arup Group and Novo Nordisk. All three of these were on the sites’ root domain,” the note explained.
“No subdomain enumeration or URL crawling necessary; any of the millions of visitors to the site could have right-clicked ‘inspect’ and seen the keys just sitting there, plain as day. On all three websites.”
MAG manages Manchester Airport, Stansted Airport and East Midlands Airport.
Read more on MAG breach: Manchester Airports Group Hit by Cyber Incident.
The FulcrumSec post also claimed that the group obtained a much broader sweep of customer information than at first revealed by MAG.
It said it exfiltrated nearly 8.7 million customer profiles, including email, name, mobile number, home town, postcode and residential IP address. That could enable convincing follow-on phishing attacks on victims.
Also swept up in the data breach were allegedly:
Nearly 1.2 billion marketing events including sends, opens and clicks
Nearly 2.5 million purchases – every booking that customers of parking, Fast Track and lounges have ever made
Over 461,000 SMS messages with passenger booking date, car park and vehicle reg in plain text
108,000 unique vehicle registration plates
Platform configuration data
Physical Danger for Travellers
FulcrumSec also claimed to have data on nearly 191,000 future bookings, which includes travel schedules, PII and vehicle information that could be used by criminals to physically target holidaymakers’ homes.
It said that some of these individuals were likely public figures, politicians and military staff, judging by the email addresses associated with the bookings.
“Sadly MAG declined to pay the necessary fee to protect their passengers’ data, leaving us to remove the most sensitive parts … from the leak prior to publication,” the group added.
The group's claims have yet to be fully verified and MAG has not provided any update since its original post on August 27.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/fulcrumsec-manchester-airport/