Your Boarding Pass Is Now Public Domain

# Your Boarding Pass Is Now Public Domain 8.8 million. That's the number of people whose data just leaked following the hit on Manchester Airports Group. If you were paged at 3am for this, you wouldn't be looking at a single server. You'd be looking at a catastrophe of aggregation. Usually, these leaks are surgical. A specific database, a misconfigured bucket, a few thousand records. 8.8 million is different. It's the scale of an entire ecosystem. When an airport group goes down, it isn't just about flight schedules. They hold everything: loyalty data, parking registrations, passport details, and payment tokens. The number is striking because it proves we're still hoarding PII like it's a trophy. We keep data long after its utility expires, then act surprised when criminals treat our servers like an all-you-can-eat buffet. Look at the rest of the wire from this week. There were 465 stories on data breaches alone. That's not a trend; it's the baseline. We saw another breach in the education sector affecting 1.1 million users. Then there's DaVita, which just settled for $15 million after exposing records for 2.4 million patients. The math here is grim. The cost per record in a settlement is peanuts compared to the value of that data on the dark web for a sophisticated group. Someone will argue that airport groups are "critical infrastructure" and have higher security standards than a random retail chain. That's a fantasy. Criticality doesn't equal security. Most "critical" systems are just layers of legacy middleware held together by hope and a few outdated API keys. If you can move laterally from a parking payment system to a passenger manifest database, your "critical infrastructure" is just a wide-open door. The real damage isn't the immediate leak. It's the second-order effect. 8.8 million people didn't just lose an email address; they lost their travel profiles. This is gold for spear-phishing. Imagine receiving a perfectly timed, highly credible "urgent update" about your upcoming flight to Malaga, tailored with your actual booking reference and passport number. The success rate on those phish will be north of 90 percent because the trust is already baked into the data. It rhymes with the big aggregator breaches of the last decade, but there's a twist here. This isn't just financial data; it's movement data. Knowing where millions of people go, when they go, and how they get there adds a physical dimension to the risk that a credit card leak doesn't have. While we obsess over the 8.8 million, Babuk is quietly using CVE-2026-59310 to hit organizations across 47 nations via VMware vCenter. That's the other side of the coin. One group steals the data; another uses a single vulnerability to burn down the house in nearly fifty countries. The industry likes to talk about "risk appetite." I don't think anyone has an appetite for this level of exposure. The question now is who else is sitting on ten million records they can't actually protect. If you're running a legacy database with millions of entries and your only defense is a firewall and a prayer, you aren't managing data. You're hosting a liability. I'll believe the "security improvements" when I see the deletion logs for data that should have been purged five years ago. Until then, keep an eye on your travel alerts.