Thousands of Scottish holidaymakers are being invited to join a £100 million legal action against airports after their personal data was stolen in a major cyber attack. The action follows the theft of email addresses, phone numbers, vehicle registrations and postcodes when hackers broke into databases containing Wi-Fi login and car parking details of customers.
When the airports’ operator refused to meet demand for an undisclosed ransom payment, the gang then published personal data relating to nearly nine million people online. The information involved related to services including airport Wi-Fi registrations, car parking, airport lounges and Fast Track bookings.
Details of the breach
The personal details included those of a judge, politicians, celebrities and defence workers, reportedly published on the dark web. Manchester Airports Group (MAG) is now facing action after data was stolen from an estimated 8.7 million customers using Manchester, Stansted and East Midlands airports.
The budget airline hubs are used by hundreds of thousands of Scots every year who travel south to access cheaper fares. They could claim for hundreds of pounds each, with total compensation across the UK expected to be up to £100 million.
Legal action launched
Thompsons Solicitors have launched a class action after the airport operator, having previously represented thousands of clients in similar hacking cases against Arnold Clark and Marks and Spencer. Senior partner Patrick McGuire said: “The Data Breach affecting passengers at Manchester, East Midlands and Standstead airports was absolutely appalling.
“We already know that the personal data of almost 9 million passengers has been released to criminal groups. The airport group are responsible for peoples’ email addresses, post codes and vehicle number plates amongst other information now being used by crime gangs and we believe hundreds of thousands of Scots have been hit.
“This causes huge anxiety and anyone who has received an email from Manchester Airport Group alerting them to this have a good claim for compensation and my highly experienced team will make sure they secure that compensation.”
Affected passengers urged to check
Across the summer months a record 20 million passengers travelled through MAG airports, with Manchester in particular attracting hundreds of thousands of Scottish fliers. The airport giant contacted affected customers via email, but many may not have been aware of the email’s content.
The law firm is now urging passengers to check if Manchester Airports Group had contacted them to alert them that their information was affected. The hackers, reported to be from cyberextortion group FulcrumSec, breached IT systems on August 22 and 23. MAG later confirmed the attack on August 27.
Customers’ details are understood to have been obtained when getting access to car parks, in lounges and after logging on to Wi-Fi access inside the airports. Banking or payment details are not believed to have been stolen.
In 2025, hundreds of Scottish customers joined a class action against M&S after the Sunday Mail revealed the retail giant is facing a multi-million pound case for failing to keep personal data safe. It came after hackers obtained customer and staff information that could include home addresses, dates of birth, phone numbers and online ordering histories of millions of people.
