Business Data Breach Insurance: Lessons from the Manchester Airports Group Incident

The Manchester Airports Group incident shows how a cyber event can continue after the initial system access has been contained. For any business holding customer names, contact details, vehicle information or booking records, the follow-on risks can include scams, notification costs, legal questions and reputational damage.

MAG said an unauthorised third party obtained customer data linked to bookings and airport Wi-Fi sign-ups. The information included email addresses, phone numbers, vehicle registrations and postcodes.

A material update followed in early September, when reporting said attackers had published stolen data online after an extortion attempt. That creates a different problem from simply restoring systems. People whose information was taken may remain exposed to targeted fraud and convincing follow-up messages.

 

Why the follow-on stage matters

A business may contain an incident quickly and still face weeks or months of work afterwards.

The business may need to:

• Establish what information was accessed.
• Identify which customers, employees or suppliers may be affected.
• Preserve evidence and investigate the access route.
• Decide whether notifications are required.
• Handle customer enquiries.
• Monitor for further misuse.
• Manage legal, regulatory and public-relations consequences.

 

The exact obligations depend on the facts, the data involved and the applicable law. The insurance response also depends on the policy wording and circumstances.

A breach can be especially difficult for smaller firms because the same people may be dealing with operations, customers, IT suppliers and the insurer at the same time.

 

What can smaller businesses learn?

The first lesson is to understand what data the business actually holds. A transport company may focus on route and payment systems but overlook the information stored in customer portals, proof-of-delivery records, driver applications, vehicle registration records or old spreadsheets.

 

A basic data map should identify:

• What information is held.
• Where it is stored.
• Who can access it.
• Which suppliers can access it.
• How long it is retained.
• What happens if the system is unavailable or compromised.

 

The second lesson is to review supplier access. A breach at an outsourced IT, booking, payroll, fleet or software provider can still affect the business and its customers. The contract should explain responsibilities, notification arrangements and access controls, although contractual wording does not remove every risk.

The third lesson is to plan communications before an incident. A business should know who can approve customer messages, who will liaise with professional advisers and how staff will be warned about suspicious follow-up emails or phone calls.

 

How does business data breach insurance help?

Cyber Liability Insurance may be structured to address defined costs connected with a cyber incident. Depending on the policy, this can include areas such as forensic investigation, legal advice, notification, data restoration, revenue loss, extra expense, extortion and third-party claims.

That is not a guarantee that every cost will be covered. Limits, exclusions, waiting periods, conditions and the cause of the incident all matter. Some losses may also sit outside the policy because they arise from ordinary trading pressure, an uninsured system or a particular contractual responsibility.

 

The policy should be reviewed alongside the response plan. Check:

• Which systems and data are declared.
• Whether outsourced IT and cloud providers are included in the risk picture.
• Whether the business understands how to notify the insurer.
• Whether incident-response contacts are available outside normal hours.
• Whether the limits reflect the likely cost of customer communication and operational recovery.
• Whether staff know not to delete evidence or make unauthorised statements after an incident.

 

Early notification can matter because the insurer may have requirements about approved experts, investigation or claims handling. Businesses should follow their policy instructions and obtain appropriate legal advice where necessary.

 

Prepare for data being used after the breach

The most visible part of a cyber incident may be the initial outage. The longer tail can involve customer concerns, attempted scams and pressure on staff.

A short tabletop exercise can test whether the business knows how to respond. Use a realistic scenario involving stolen customer information, a supplier system and a message from a journalist or affected customer. The purpose is to find gaps in decision-making before the pressure is real.

A data breach plan cannot remove every consequence. It can reduce confusion and help the business act consistently.

If your business stores customer, employee or supplier data, Ratcliffes can discuss the insurance questions that sit alongside your cyber response plan. Call 01242 544544 to review the cover, limits and information your insurer may need if an incident occurs.

 

Sources

• Manchester Airport, “Manchester Airport Data Security Incident: Update and FAQs”, 27 August 2026
• IT Pro, “Manchester Airports Group attack: Millions of holidaymakers urged to look out for scams as hackers publish stolen data online”, 3 September 2026
• TechRadar, “Manchester Airports hackers post data of 8.7m people”, 2 September 2026