Three major UK airports have been hit by a “cyber security incident” in which criminal hackers accessed the data of almost nine million people and demanded a ransom.

Manchester Airports Group (MAG), which owns Manchester, East Midlands and London Stansted airports, said customers’ contact details, vehicle registrations and postcodes were obtained by hackers at the weekend.

MAG told the BBC the hackers demanded a ransom fee for the return of the data, which the group said it refused to pay. The sum of the ransom fee was not disclosed.

The firm said "at no point has passenger safety or aviation security been compromised” and the system hacked did not hold customers’ bank or payment details.

The data of about 8.7 million customers was accessed.

The majority of the data accessed was restricted to customer email addresses and related to WiFi sign-ups within the airports’ terminals, MAG said.

MAG said in a statement: “We would like to reassure customers that Manchester Airport Group takes the security of customer information extremely seriously and we apologise for any inconvenience or concern caused.”

East Midlands Airport was one of those affected, along with Manchester and London Stansted

The firm said it only became aware of the hack on Tuesday and quickly prevented the hackers gaining any more access, and notified affected customers.

“We immediately contained the risk and have been working with specialist advisors and taking appropriate steps to protect our customers and systems,” MAG said.

“We have informed and are working with the relevant authorities.”

The hackers managed to steal email addresses after customers accessed WiFi in the airports

The airport group said the e-mail addresses obtained by the hackers came from passengers signing up to the airports’ on-site WiFi.

More detailed data, including vehicle registrations, came from people booking car-park spaces, arranging access to lounges, and booking fast-track.

Customers are urged to remain vigilant about suspicious emails, text messages or phone calls and avoid opening unknown attachments.

‘Alarming’

Michael Goddard, 71, from Cheshire, said both he and his wife, Julie, 68, had received an email earlier from MAG notifying them that their data had been breached.

“I was shocked,” Goddard told BBC Radio Manchester. “To find your personal info has been stolen – it is alarming.

“My information has gone and I don’t know what they’re going to do with it.

“They have my address in the form of the postcode, they’ve got my name, so it doesn’t take too much to find out who I am.

“I’m not 100% reassured by what Manchester Airports Group has said.”

Goddard said he received the email after travelling from East Midlands Airport earlier this year and his wife had used the online booking service for parking at Manchester Airport.

“The concern is there for both of us,” he said. “We want the reassurance that if anything happens, they will adequately compensate us.”

The identity of the hackers was known, MAG said, and the relevant authorities had been informed.

The Information Commissioner’s Office said it was assessing the incident.

“We can confirm we have received a breach report from Manchester Airports Group, and we are assessing the information provided,” a spokesperson said.

The organisation said anyone concerned by the breach was able to access support on the ICO website. (BBC)