Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal

The root failure here was a critical secrets management error: administrative API keys or credentials were embedded directly in client-side JavaScript, making them publicly accessible to anyone who inspected the website's source code. This is a fundamental configuration management failure that effectively handed attackers the keys to the kingdom without requiring any sophisticated exploitation. The breach highlights how a single developer oversight in handling secrets can cascade into a massive data exposure affecting millions of individuals. MAG's refusal to pay the ransom, while principled, underscores that organisations must invest in prevention rather than relying on post-breach negotiations. The publication of 550GB of personal data now exposes those 8.8 million individuals to identity theft, phishing, and fraud for years to come.