"A Hack, Not a Lapse": The Story You Tell in Week One Is the Liability You Own in Week Six

On August 27, Manchester Airports Group — the UK's largest airport operator, running Manchester, London Stansted, and East Midlands — disclosed that an unauthorized third party had stolen customer data. The company told The Register that about 8.7 million customers were affected, that it had received an extortion demand, and that it had not paid. A spokesperson described the incident as "a hack, not a lapse" — a sophisticated attack, not human error.

Three days later, the extortion group FulcrumSec claimed the breach and told a different story. It said it got in using admin keys for MAG's marketing platform that were sitting in the public JavaScript of all three airport websites, where anyone who viewed the page source could read them. On September 2, after MAG declined to pay, the group published roughly half a terabyte of data. HaveIBeenPwned parsed the dump and loaded 8.8 million email addresses and phone numbers into its database.

MAG has not addressed the group's claim about the keys, and I want to be careful here: the attackers' account is unverified, and criminals have every incentive to embarrass a victim who refused them. But the gap between the two stories is the part of this incident that belongs in a boardroom.

The Ransom Decision Was Right. It Was Also the Easy Part.

Let me get the obvious question out of the way. MAG was right not to pay. FulcrumSec does not encrypt anything; according to Sysdig's threat researchers, the group calls its own model "steal and squeeze" — take the data, threaten to publish, sell or dump it if the victim refuses. Paying a group like that buys a promise from people whose entire business is breaking promises. And the money would have funded the next attack on the next company.

In my experience, boards spend most of their incident energy on the pay-or-don't-pay question, because it feels like the decision that matters. It is not. That decision was made the day the data was collected. The consequential decisions were made months and years earlier — what to collect, where to store it, who holds the keys, and whether anyone ever checks.

Look at What Was Actually Stolen

MAG said the compromised data came from car park, lounge, and Fast Track bookings, plus in-airport Wi-Fi sign-ups. It told The Register that the overwhelming majority of affected people had only an email address exposed, most of it collected when travelers signed up for free airport Wi-Fi. The next largest group was people who started a booking and never finished it.

Read that again. The bulk of an 8.7-million-person breach was marketing data — email addresses harvested at the Wi-Fi login page and abandoned shopping carts. None of it was needed to land a plane or park a car. It was collected because collecting it was free and might be useful someday.

That is the pattern I see in nearly every large consumer breach. The crown jewels are usually well guarded. The liability lives in the systems nobody thinks of as important — the marketing platform, or the third-party database a vendor hosts and a junior team administers. MAG confirmed the stolen files came from a database hosted by a third party. According to the attackers, it was the marketing automation platform. Either way, it was not the flight operations system, and it did not need to be.

"A Hack, Not a Lapse" Is a Bet, Not a Finding

I understand why MAG said it. In the first 72 hours, a company wants to project competence and tell customers their safety was never at risk — which, by every account, is true. Airport operations were never affected. No payment data was in the system.

But "not a lapse" is a conclusion, and MAG offered it before the forensic investigation could possibly have been complete. If the attackers' claim holds up — if credentials with administrative access to 8.7 million customer records were readable in the public source code of three websites — then "sophisticated attack" becomes the phrase every regulator and plaintiff's lawyer quotes back at you. The UK Information Commissioner's Office, which is already involved, will not be grading MAG on its press release.

This is the point I make in Cyber Risk Is Business Risk about board communication during an incident: your first public statement is a liability document. Say what you know. Say what you are still finding out. Do not characterize the cause until you can defend the characterization under oath. "We are investigating how the attackers gained access" costs you nothing. "A hack, not a lapse" is a bet against your own forensic report.

The Third Party Held the Data. You Hold the Consequences.

FulcrumSec has previously claimed breaches at LexisNexis and Novo Nordisk, and Sysdig's analysis says the group specializes in cloud-native businesses with hardcoded credentials, unpatched applications, or misconfigured storage. Nothing exotic. The group looks for keys that were left where keys should never be and walks in the front door.

If your company uses a marketing automation platform — and it does — someone on your team holds API keys to it. Those keys often carry the power to export your entire customer list. Ask yourself whether anyone outside the marketing department has ever reviewed who holds them, where they live, and whether they have ever been rotated. In my experience, the answer is no, because marketing tools sit outside the security team's line of sight and inside a budget the CISO does not control.

What to Ask Your CISO This Week

Five questions. None require a technical background, and every one has a numeric or yes-no answer.

1. Which of our customer-facing websites contain embedded credentials or API keys? The right answer is a scan result, not an opinion. Client-side code is public by definition; anything in it is already disclosed.
2. What is the complete list of third-party platforms that hold our customer data, and who owns the keys to each one? If marketing, HR, and sales tools are missing from the list, the list is wrong.
3. How much personal data do we hold that no business process actually requires? Wi-Fi sign-ups, abandoned bookings, dormant accounts. Every record you delete is a record that cannot be leaked.
4. If a group like FulcrumSec published everything in our marketing platform tomorrow, what would be in it? Make someone answer in specifics — fields, record counts, date ranges. That is the exposure the board actually carries.
5. Who has authority to characterize the cause of an incident publicly, and what evidence do they need before doing so? Write it into the incident response plan. The people drafting the press release should not be guessing.

MAG made the hard call correctly and refused to fund criminals. It may yet turn out that the easy calls — the ones made years earlier about what to collect and where to leave the keys — are the ones that cost it the most.