Security boffin claims airport group left API keys in client-side JavaScript for four years
Security researcher Scott Helme says his own investigation corroborates claims by extortion group FulcrumSec that Manchester Airports Group (MAG) exposed privileged API keys for the Iterable marketing platform in publicly accessible JavaScript on the websites of Manchester, Stansted and East Midlands airports. Helme used the Wayback Machine to show the keys had been embedded in front-end code since 2022 and remained there until August 2026, meaning anyone inspecting the page source over four years could have harvested them — a serious lapse given the data allegedly belonging to 8.8 million customers was stolen last month.
Helme found the keys were far more privileged than needed for their stated purpose of tracking marketing email clicks, granting read/write access to customer profiles, parking and lounge bookings, and Fast Track purchases, as well as the ability to delete records entirely — meaning the attackers could potentially have wiped MAG's database rather than merely copying it. MAG has called the breach "sophisticated" and "a hack, not a lapse," declined to comment on Helme's findings, and disputes his characterisation, while continuing to work with the ICO and National Crime Agency. FulcrumSec published the stolen data on 2 September after MAG refused to pay a ransom the ICO said was lower than typical extortion demands.
In short
- Researcher says MAG exposed Iterable API keys in public JavaScript since 2022
- Overprivileged keys reportedly let attackers read and could delete 8.8m records
- MAG disputes claims, calls it a hack; ICO and NCA now involved
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Helme’s findings, if accurate, suggest MAG left powerful keys in public-facing code for years, despite needing only limited access for marketing tracking. That could have made customer data easier to steal and points to a preventable security failure, especially given the reported breadth of access and the eventual exposure of millions of customers’ records.
The case against
MAG’s description of the incident as a sophisticated hack raises the possibility that the attackers used methods beyond the exposed keys, so their presence alone does not establish how the data was taken or that the breach was avoidable. The findings are Helme’s account, and without MAG’s response to them or a completed investigation, the keys’ role in the theft and the full circumstances remain unsettled.
Explained simply
Manchester Airports Group, or MAG, operates Manchester, London Stansted and East Midlands airports. Iterable is a service businesses use to manage marketing messages and customer data; website code can contain keys that let systems connect to such services.
Security researcher Scott Helme says MAG’s airport websites exposed keys that could access customer profiles and booking records. The reported incident matters because the keys may have allowed changes or deletions as well as access, while the breach has raised questions about how customer data was protected.
MAG describes the breach as a sophisticated hack and disputes that it resulted from a security lapse. The Information Commissioner’s Office and National Crime Agency are involved, and the case concerns data reportedly linked to 8.8 million customers.