Critical

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal

SecurityWeek

September 3, 2026 at 3:35 PM

Actively Exploited

Overview

The Manchester Airports Group (MAG) has suffered a significant data breach, with hackers leaking around 550GB of sensitive information related to 8.8 million individuals. This incident occurred after MAG reportedly declined to meet the ransom demand from the attacking group. The hackers claimed they accessed the data through exposed administrative keys, raising concerns about the security measures in place at the airport group. This breach not only compromises the personal information of millions but also highlights the ongoing risks organizations face from ransomware attacks and the importance of securing sensitive data. As the fallout from this incident unfolds, it serves as a reminder for companies to reinforce their cybersecurity practices and be vigilant against potential vulnerabilities.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Manchester Airports Group data, personal information of 8.8 million individuals
Action Required: Companies should implement stronger security measures, including securing administrative keys and regularly auditing access controls.
Timeline: Newly disclosed

Original Article Summary

Hacker group published roughly 550GB of data after MAG reportedly refused to pay a ransom demand; the group says it gained access via exposed admin keys. The post Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal appeared first on SecurityWeek.

Impact

Manchester Airports Group data, personal information of 8.8 million individuals

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Companies should implement stronger security measures, including securing administrative keys and regularly auditing access controls.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Ransomware, Data Breach.

Read Original Article

Related Coverage

Attackers exploit zero-days in consistently besieged SonicWall product

CyberScoop

SonicWall's SMA 1000 appliances are facing significant security challenges, with attackers actively exploiting five zero-day vulnerabilities since late 2025. These vulnerabilities have put SonicWall customers at risk, as they have been under attack for years. The ongoing exploitation means that organizations using these devices need to be particularly vigilant about their security posture. This situation raises concerns about the reliability of SonicWall products and highlights the importance of prompt patching and updates to mitigate such risks. As attackers continue to target these vulnerabilities, it is crucial for affected users to stay informed and take necessary precautions.

Sep 3, 2026

Coder's registry infrastructure compromised to push malicious modules

BleepingComputer

Attackers have breached Coder's Cloudflare infrastructure, enabling them to insert unauthorized registry servers. These servers distributed malicious Terraform modules that contained code designed to steal user credentials. This incident poses a significant risk to developers and organizations that rely on Terraform for infrastructure management, as they could unknowingly use compromised modules, leading to potential data theft and security breaches. Users of Coder's services need to be vigilant, as the malicious code could affect their systems and expose sensitive information. The incident underscores the necessity for robust security measures when integrating third-party modules into development workflows.

Sep 3, 2026

HPE patches critical ArubaOS-CX remote code execution flaw

BleepingComputer

Hewlett Packard Enterprise (HPE) has addressed a serious security vulnerability in its ArubaOS-CX network operating system. This flaw could allow attackers to execute remote code, potentially compromising affected systems. Organizations using ArubaOS-CX are at risk, as this vulnerability could lead to unauthorized access and manipulation of network functions. HPE has released patches to fix the issue, and it's crucial for users to update their systems promptly to prevent exploitation. Cybersecurity experts recommend that companies prioritize applying these updates to safeguard their networks from potential attacks.

Sep 3, 2026

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

The Hacker News

In this latest update on cybersecurity threats, attackers are increasingly using tactics that exploit user trust and familiarity. Phishing kits targeting CEOs are on the rise, alongside hacks affecting around 5,000 Dropbox accounts. These attacks often appear legitimate, with users receiving calls from IT, sharing files, or being prompted to click 'Allow' on trusted apps. Additionally, attackers are employing fake login pages and old account links to trick users into giving up their credentials. This highlights the need for heightened awareness and caution when interacting with seemingly innocuous requests, as one small mistake can lead to significant breaches.

Sep 3, 2026

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

The Hacker News

Cisco has issued critical patches for a vulnerability in its Nexus 9000 series switches, specifically those based on Silicon One architecture. This flaw, identified as CVE-2026-20212, carries a CVSS score of 9.8, indicating a severe risk. It allows remote attackers, without needing to authenticate, to execute code with root privileges on impacted systems. Alongside this vulnerability, Cisco also released a hardening update for IOS XR that includes seven additional CVEs, two of which are also rated very high at 9.8. Users of these Nexus switches should prioritize applying the patches as there are currently no workarounds available for the IOS XR versions affected.

Sep 3, 2026

OpenAI confirms ChatGPT is down ahead of 'Astra' model launch

BleepingComputer

OpenAI's ChatGPT and Codex platforms are currently facing a significant outage, affecting users who are unable to access nearly all major features of ChatGPT. This incident comes just ahead of the anticipated launch of the new 'Astra' model, raising questions about the stability and reliability of OpenAI's services during critical updates. Users have reported various errors, indicating widespread issues across the platforms. This situation highlights the challenges that can arise during major software upgrades and the potential impact on users who rely on these tools for various applications, from casual interactions to more complex coding tasks. OpenAI has not provided a specific timeline for resolving the outage, leaving users in the dark about when they can expect normal service to resume.

Sep 3, 2026