99% of exposed staff credentials in UK aviation’s public web estate sit with suppliers, not airports

Why two halves

On 27 August 2026 Manchester Airports Group disclosed that about 8.7 million passenger records had been taken from car-park, lounge, Fast Track and wi-fi systems. That was the commercial web estate, not the airside one.

Eleven months earlier, ransomware against Collins Aerospace’s MUSE check-in software disrupted Heathrow, Brussels, Berlin and Dublin. No airport was breached. One shared supplier was.

Those are two different estates. This study measured both, the same day, the same routine.

What we found

Airport operators (43 websites, 54 airports): average 66.6, median 66. Ten staff credentials at four operators. No ransomware leak-site mentions and no risky port on an address of their own.

Suppliers (48 of 51 scored): average 65.9, median 67. 1,161 staff credentials. Three leak-site mentions. All three risky ports on an organisation’s own address, one of them an identified database server. Security and assistance, and ground operations, are the weakest classes. 92% of the staff-credential exposure sits in three airside supplier classes, and three organisations hold 820 of the supplier records.

Four further port cases (two operators, two suppliers) sit on shared hosting addresses where no service of the organisation’s own was identified. They are reported separately because only the provider can confirm or close them.

The one measure on which the airports are worse is email authentication. Forty per cent cannot tell receiving systems to reject mail forged in their name. It is the cheapest finding in either half to fix, and the airport name is the more attractive one to forge.

A combined average of 66.2 hides the split. Do not use it as the headline.

21 of the 91 scores (12 operators, 9 suppliers) are floors, not readings. Those homepages answered the scanner with a bot-protection page, so their security headers could not be read, and the true score can only be the same or higher. Refusing an unknown automated visitor is a security control, not a failing. Three supplier websites, all lounges, completed without a score and are excluded from every figure.

What this is not

It is not a claim that any airport system has been accessed. We could not see inside one and did not try. It is not a league table. No organisation is named. Nothing here is a verdict.

Where to start

1. Establish which airports use the three ransomware-mentioned suppliers, and what access they hold.
2. Ask ground-handling, passenger-processing and airfield-technology suppliers what credential hygiene they operate.
3. Publish an enforcing email policy — one DNS record, nothing airside.