decrypted · 31 august 2026 · ransomware and cybercrime · supply chain · uk policy and law

Manchester Airports: the master key was sitting in the browser all along

Manchester Airports Group's data breach, first disclosed on 27 August, got both bigger and clearer this week. The extortion group FulcrumSec has claimed responsibility, published sample records that go well beyond the "mostly email addresses" MAG described at the time, and said exactly how it got in: airport-specific credentials for the marketing platform Iterable, left exposed in client-side JavaScript. MAG has not disputed the technical claim, only the scale, and BleepingComputer independently validated at least one sample record against a traveller's own booking history. The company says it refused to pay a ransom.

The key wasn't stolen, it was published

Here is the plain-English version of what "exposed in client-side JavaScript" means. When your browser loads a website, it downloads the code that runs the page, and that code is fully visible to anyone who opens developer tools, a feature built into every browser. If a developer embeds an API key in that code so the page can talk to a third-party service, they haven't hidden the key. They've published it, to every visitor, indefinitely. It's the digital equivalent of taping the stockroom key under the till and calling the shop secure because customers aren't supposed to look under there.

FulcrumSec says the credentials it found unlocked a consolidated customer export: booking references, Fast Track purchases, terminal and arrival times, parking dates, and roughly 200,000 records tied to travel still to happen in 2026. Combine a name with an upcoming flight date and terminal, and you have everything needed for a convincing "your booking has a problem" phishing message. No payment card data has surfaced in samples reviewed so far, which is the one piece of good news in an otherwise uncomfortable update.

Rebuilding trust needs more than a statement

The Secure by Design lesson here isn't about MAG's competence relative to peers; plenty of sites do this. It's that a credential embedded in anything shipped to a browser should be treated as public from the moment it's written, not from the moment someone notices it. The fix is architectural, not procedural: third-party API calls that need a secret should be brokered server-side, with the browser talking to your own backend and the backend holding the real key. Where a client genuinely needs to call a service directly, the token issued should be short-lived, scoped to the minimum action required, and rotated automatically, so that finding it in a page's source code buys an attacker very little. Secret-scanning in the build pipeline, run before code ships rather than after a researcher emails you, would have caught this before it reached a single browser. For any UK organisation running customer-facing marketing or booking integrations, this is worth an afternoon checking your own bundles rather than assuming it's someone else's mistake.

Also this week

The Cyber Security and Resilience Bill reaches the House of Lords committee stage on 1 September, its first line-by-line scrutiny since clearing the Commons in June. The bill widens the existing NIS Regulations to cover managed service providers and data centres directly, adds a power to designate specific critical suppliers, and introduces a two-stage incident reporting duty: notify within 24 hours, full report within 72. Penalties run to £17 million or 4% of global turnover. Full effect is years away, arriving through secondary legislation around 2028, but any UK organisation that might qualify as a relevant MSP should start working out now whether it does.

Australian police have charged two Perth men, Ruben Thomson and Louis Gaebler, over the TeamPCP supply chain campaign that compromised the open-source AI gateway LiteLLM and other developer tools since March. Investigators say the operation touched over a thousand organisations, exposed more than 500,000 credentials, and pulled at least 300GB of data, largely by harvesting secrets from CI/CD pipelines. It's the same failure mode as the Manchester Airports story from a different angle: once a credential leaves a controlled environment, whether that's a public browser bundle or a build pipeline, it stops being a secret and starts being a liability someone else gets to use.

Sources

Want a second pair of eyes on how your organisation handles secrets and third-party integrations? Get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.