The data accessed includes email addresses, phone numbers, vehicle registrations and postcodes

Assessment

MAG's statement lists those four fields and has not been updated. The data set published on 30–31 August and loaded by Have I Been Pwned on 2 September contains names, email addresses, phone numbers, IP addresses, browser user-agent strings, geographic locations, purchase records and vehicle registration plates; FulcrumSec's inventory adds ~461,000 SMS messages, ~2.5 million purchases and ~191,000 future bookings with dates. MAG's list was accurate as far as it went on 27 August and is now a subset of what is public.