Manchester Airports Group exposed over-privileged API keys in website code for four years

Scott Helme, a security analyst, traced three Iterable API keys that were embedded in the JavaScript delivered by Manchester Airports Group’s three airport sites—Manchester, Stansted and East Midlands—from June/July 2022 until August 2026. The keys were over-privileged, granting read/write access to core Iterable endpoints, which could reveal or delete customer profiles, parking, lounge bookings and Fast Track purchases.

Although the keys were not directly visible in the HTML, they were discoverable in the client-side code, violating Iterable’s guidance that such credentials remain server-side. Helme believes the exposure allowed the theft of data belonging to roughly 8.8 million MAG customers, as indicated by the data released by the extortion group. MAG described the breach as a “sophisticated hack” and is working with the Information Commissioner’s Office and the National Crime Agency, while denying that the breach required any hacking on the part of the attackers. FulcrumSec, the security firm that first reported the issue, released the compromised data on September 2 after MAG refused to pay the ransom.