Exposed Admin Keys in Public JavaScript Led to 8.8M Record Breach at Manchester Airports
The root failure here was a critical secrets management error: administrative API keys or credentials were embedded directly in client-side JavaScript, making them publicly accessible to anyone who inspected the website's source code. This is a fundamental configuration management failure that effectively handed attackers the keys to the kingdom without requiring any sophisticated exploitation. The breach highlights how a single developer oversight in handling secrets can cascade into a massive data exposure affecting millions of individuals. MAG's refusal to pay the ransom, while principled, underscores that organisations must invest in prevention rather than relying on post-breach negotiations. The publication of 550GB of personal data now exposes those 8.8 million individuals to identity theft, phishing, and fraud for years to come.
Tactical Insight
Immediate actions
- Audit all frontend JavaScript, mobile app bundles, and public-facing web assets immediately to identify and rotate any exposed credentials, API keys, or tokens.
- Rotate all potentially compromised admin keys and secrets across every system that shared those credentials without waiting to confirm scope.
- Engage a threat intelligence service to monitor dark web and leak sites for published data to enable timely notification to affected individuals.
Long-term improvements
- Implement a dedicated secrets management solution (e.g., HashiCorp Vault, AWS Secrets Manager) to ensure credentials are never hardcoded into source code or build artifacts.
- Enforce pre-commit hooks and CI/CD pipeline scanning tools (e.g., GitGuardian, TruffleHog) to automatically block secrets from being committed to repositories or deployed to frontends.
- Adopt a principle of least privilege for all admin keys, scoping permissions to the minimum required function and enforcing short-lived, auto-rotating credentials.
Detection measures
- Deploy continuous automated scanning of all publicly accessible web assets to detect newly introduced secret leakage before attackers discover it.
- Implement SIEM alerting on anomalous admin-level API activity, particularly large data access or export operations outside of business hours.