The exposed Iterable key had been in Manchester Airport's public JavaScript since at least January 2023
Assessment
This is ThreatPaper's own finding, recorded here so it can be checked and cited. The SHA-256 hash of the key in the _app bundle archived on 22 August 2026 matches the key in archived bundles of 1 January 2023, 8 March 2023 and every later build examined; no different value appears in the interval. The archive shows the key's presence in the shipped code, not whether it remained valid in Iterable throughout, which only MAG can state. Nothing in the coverage gives a duration; MAG's statement gives none.
Where this claim appeared
ThreatPaper · 2026-09-13
https://threatpaper.com/cases/manchester-airports-group-breach-the-iterable-key-in-the-front-end-javascript-since-2023What “Verified” means
Established by primary sources — the original disclosure, a vendor incident report, a court filing, a government advisory, or the affected party itself. Where a claim is material, at least two independent sources agree.
5 of 5 · rating scale
Assessed in
Manchester Airports Group Breach: The Iterable Key in the Front-End JavaScript Since 2023Think this assessment is wrong? Report an error.