Parking and Wi-Fi sign-ups leaked. Every booking form holds data.
A breach at three UK airports came through everyday booking and Wi-Fi systems. Hotels, restaurants and attractions run the same kinds of forms.
By the Xuru Technologies team · 26 September 2026
Key takeaways
- Manchester Airports Group disclosed on 27 August 2026 that data on about 8.7 million people was exposed.
- It covered Manchester, London Stansted and East Midlands airports.
- Data linked to parking, lounge and fast-track bookings and Wi-Fi sign-ups was involved.
Small add-on services, like parking or guest Wi-Fi, often use third-party systems that get less security attention than the main website.
What happened
The Retail & Hospitality ISAC summarised the disclosure, which attributed the breach to an unauthorised third party. University of West London research tracks cyber risk across hotels, restaurants and tourism.
What it means for hospitality businesses
- Every form is a data store. Bookings, Wi-Fi and newsletters all collect personal data.
- Third parties add risk. Know who hosts each system.
- UK GDPR applies. Breaches must be reported and handled properly.
Data protection checklist
| Step | Why |
|---|---|
| List every system that holds guest data | You can't protect what you don't know. |
| Collect only what you need | Less data, less risk. |
| Review vendor security | Ask about encryption and breach handling. |
| Delete old records | Set retention periods. |
| Have a breach response plan | Act fast if it happens. |
Frequently asked questions
What happened at Manchester Airports Group?It disclosed in August 2026 that data on around 8.7 million customers, linked to bookings and Wi-Fi sign-ups, was accessed by an unauthorised party.
It disclosed in August 2026 that data on around 8.7 million customers, linked to bookings and Wi-Fi sign-ups, was accessed by an unauthorised party.
Are small hotels at risk too?Yes. Booking engines, Wi-Fi portals and email lists all hold personal data that attackers target.
Yes. Booking engines, Wi-Fi portals and email lists all hold personal data that attackers target.
What should I do if my business has a breach?Contain it, assess what data was affected, notify the regulator and customers where required, and get expert help.
Contain it, assess what data was affected, notify the regulator and customers where required, and get expert help.
Guest data, properly protected.
Secure booking forms, minimal data collection and hardened websites for hospitality.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply