What should I do immediately after a data breach?

Change your password for the affected account and any other account where you reused that password. Enable two-factor authentication. Monitor your bank and credit card statements. Place a free credit freeze at Equifax, Experian, and TransUnion. If your Social Security number was exposed, file an identity theft report at IdentityTheft.gov.

How long do companies have to notify me after a data breach?

In the US, notification timelines vary by state — typically 30 to 90 days after a breach is confirmed. Under GDPR in Europe, companies must notify regulators within 72 hours. Many states require individual notification "in the most expedient time possible." Companies often delay notification while investigating.

Should I freeze my credit after a data breach?

Yes. A credit freeze prevents new accounts being opened in your name without your explicit unfreeze. It is completely free at all three major bureaus, does not affect your credit score, and does not impact existing accounts. Unfreeze temporarily when you need to apply for credit, then refreeze immediately.

Free Airport WiFi Put 8.7 Million Travelers at Risk After Hackers Stole Their Personal Data

You Didn't Buy Anything. You Still Got Breached.

You connected to airport WiFi, typed in your name and phone number, and got on with your day. That felt like nothing. On August 27 2026, Manchester Airports Group confirmed it was not nothing. Hackers stole the personal data of 8.7 million customers, people who had done exactly that.

The breach hit Manchester Airport, London Stansted, and East Midlands Airport. Email addresses, phone numbers, vehicle registration plates, and postcodes were all taken. No payment details were exposed. That sounds like a relief until you realize what criminals can actually do with what they did get.

Why Is "No Payment Data" Not as Reassuring as It Sounds?

Payment card fraud is detectable. Your bank flags it, reverses it, sends a new card. Identity fraud built on your name, phone number, and the fact that you flew through Manchester on a specific date is much harder to unwind.

This breach hit the customer data platform, the system that stitches together WiFi sign-up records, car park bookings, lounge reservations, and fast-track security passes. Attackers now know real names tied to real travel behavior. That combination is precisely what makes a phishing text or email convincing.

Imagine getting a message that says: "Your booking at Manchester Airport on [your actual travel date] requires urgent action. Click here to verify your identity." You would not immediately dismiss that. The criminal who sent it knows you were there. They stole that detail from MAG's servers.

How Free WiFi Becomes a Data Collection Machine

Free airport WiFi is not free. You pay with your data. The sign-up form, name, email, phone, sometimes your vehicle plate if you parked, feeds a customer data platform that airports use for marketing, operational analytics, and upselling lounges and parking.

None of that is hidden. It is in the terms of service that nobody reads. The data sits in a database long after your trip ends, waiting to be useful to the airport's marketing team. It also waits, as this breach shows, to be useful to someone else entirely.

This is what data retention means in practice. MAG held WiFi sign-up records for an extended period. The older that data gets, the more of it accumulates. The more of it accumulates, the more attractive the database becomes as a target. When the breach happened, attackers did not find data from last week. They found years of customer records from millions of people across three airports.

MAG said it contained the breach immediately and is working with cybersecurity specialists and law enforcement. That is the correct response. It does not help the 8.7 million people whose data has already left the building.

The Numbers

8.7 million customers affected across Manchester, Stansted, and East Midlands airports.

Data stolen: email addresses, phone numbers, vehicle registration numbers, postcodes, and the travel context those records imply.

Data not stolen: payment card or bank details.

The source: customer data collected from free WiFi registration, car parking bookings, lounge access, and fast-track security passes, retained in a single customer data platform.

The breach was disclosed on August 27 2026. If you have ever used WiFi or booked a service at any of these three airports, assume your data is in the stolen set.

What to Do Right Now

Treat any airport-related message as suspicious. If you receive a text or email referencing a Manchester, Stansted, or East Midlands booking, do not click links. Go directly to the official airport website if you need to take action.
Watch your inbox and phone for phishing. Criminals will use this data to send targeted messages that sound credible. Be especially alert to messages asking you to verify a booking, confirm a refund, or update your account.
Update your email password on any account connected to the email address you use for travel bookings. Use a strong, unique password and turn on two-factor authentication.
Check if your phone number is being impersonated. Smishing (SMS phishing) is the immediate risk here. If your mobile carrier allows you to set up a spam filter or PIN on your account, do it now.
Consider a data removal request. UK residents have the right under GDPR to request that MAG delete their personal data. You can also request confirmation of what data was held. Contact MAG's data protection team directly through their official website.
If you parked at one of these airports, your vehicle registration number is in the stolen dataset. Be alert to texts or letters claiming to relate to a parking penalty or booking, and verify any such communication through official channels before paying anything.

The Real Problem Is Invisible Until It Is Not

You did not choose to store your data with an airport's marketing platform for years. You chose to check your email on a layover. Those are not the same thing, but the terms of service made them equivalent.

Every "free" digital service runs on the same logic. The sign-up form is a data collection form. The data gets stored. Storage creates risk. Risk, eventually, creates a breach. This one exposed 8.7 million people. The next one, from a stadium WiFi network, a loyalty scheme, a parking app, will expose a different set of millions.

The only real protection is limiting what you hand over. Use a secondary email address for travel and retail sign-ups. Give your real phone number only when legally or practically necessary. Read what a service is actually asking for before you type it in.

You cannot take back what MAG already holds. You can decide what you give the next service.

Do this now:

Do not click links in any airport-related message
Change the password and enable 2FA on your travel email account
Request data deletion from MAG if you are a UK resident
Use a secondary email for any future WiFi or travel service sign-ups