Following the cyber attack on Manchester Airports Group (MAG) that exposed data belonging to around 8.7 million customers, Professor Daniel Dresner, Academic lead for Cyber Security at The University of Manchester, has outlined the key risks and the steps people can take to protect themselves.
MAG, which operates Manchester Airport, London Stansted and East Midlands, became aware of the cyber security incident on Tuesday (August 25), with the attack believed to have happened a few days earlier. Hackers accessed data relating to car park, lounge and fast track bookings and in-airport WIFI sign-ups for all three airports. The data included people's email addresses, phone numbers, vehicle registrations and postcodes.
Main risks and immediate advice
At the time, a spokesperson for MAG said the data hack was restricted to email addresses for the 'vast majority' of the 8.7 million customers affected. The security incident did not reveal any bank details. Those affected by the breach were contacted directly, and upcoming bookings are not affected.
The spokesperson added: "We would urge you to be particularly cautious of unexpected emails, calls or text messages claiming to be from us. We will never contact you unexpectedly to ask for payment or banking information. We apologise for any inconvenience or concern this may cause."
Professor Dresner highlighted the particular concern around phone numbers. "One of the major worries with this one is telephone numbers. There is the individual customer’s worry, but also the Manchester Airports Group’ worries as well, because they’ve got an awful lot of data," he said.
He advised the airport to be thoughtful in its communications with customers. "One of the worst things they can possibly do now is send people emails saying please click on this link for more information - because that’s exactly what the criminals will do," he said. "So they should certainly encourage people to go to the legitimate site - even taking caution when using search engines as they aren’t themselves infallible. So people need to be really careful where they are going and what they click on."
Protecting against follow-on fraud
MAG has stressed that it would never contact customers unexpectedly asking for payment or banking details, and has warned people to be wary of any information claiming to be from them. For the vast majority of those impacted, the data hack was restricted to email addresses, although some of the data accessed included phone numbers - something to be particularly wary of, Professor Dresner warned.
"The biggest risk is follow-on fraud. There’s enough information to contact people and then it’ll just be enough for someone to think ‘well they know my name, it must be legitimate’. People are very trusting - and we can trust, but we must also verify who is contacting us."
His number one rule is to not answer unknown callers. "Just because the phone rings, it doesn’t mean you should answer it. If it’s important it will go through to voicemail. These calls will usually ring off after three or four rings, because it’s automatic - if there’s no answer they’ll move onto the next person," he said. "Occasionally they will get through to voicemail and listen to these carefully - they will often be truncated at the start and include the usual demands of something is wrong, you need to take action. They may sound rather nice if they’re using a voice synthesiser."
Long-term protection and reporting scams
While the MAG data breach did not include bank or payment details, the cybersecurity expert has additional guidance for future protection. "Another key thing to consider is using credit cards," he said. "These things are set up to hopefully counter a certain degree of fraud. Should they be compromised you’ve got time to ring up the credit card company and argue that it wasn’t me."
"Not only do they offer protection under Section 75, but they also create an air gap between you and your bank account. If you’re using your visa card, then the money goes straight from your bank account. So a credit card gives you that extra level of protection." He also recommended subscribing to a credit agency to see if anyone takes out a loan in your name, noting some are available for a small fee while one is free to subscribe.
He added: "I think people have to be prepared. Be alert, but don’t be alarmed - you can’t be in a constant state of alarm, it’s not good for you."
If someone does fall victim to a scam, Professor Dresner urges them to report it. "One thing to remember is that there is no shame if you think you have been taken in by a criminal," he said. "People should not be ashamed to report these things straight away. You are essentially being played by professional criminals. They shouldn’t feel any guilt."
