Three major airports in Britain have been hit by a cyberattack that exposed personal information belonging to millions of passengers, raising fresh concerns over the security of data held by critical transport infrastructure.

Manchester, London Stansted and East Midlands airports were affected in the attack, with hackers gaining access to customer information including email addresses, phone numbers, postcodes and vehicle registration details, according to Manchester Airport Group.

The compromised information largely consisted of email addresses collected through airport Wi-Fi registrations. Some data linked to car parking, lounge and fast-track bookings was also accessed, the airport group said.

The attackers subsequently demanded a ransom, but the airport operator refused to pay. The amount demanded was not disclosed.

Despite the breach, the airport group said passenger safety and aviation security had not been affected and operations at all three airports were continuing normally. It also said the affected systems did not contain customers’ banking or payment information.

The incident was discovered on Tuesday, after which the company moved to contain the threat and notified relevant authorities.

Cybersecurity experts warned that seemingly less sensitive information such as email addresses, phone numbers and postcodes can still be valuable to criminals when obtained in large quantities, potentially enabling phishing, fraud, profiling and social-engineering attacks.

The airport group has urged affected customers to remain cautious of unexpected emails, phone calls and text messages and not to provide personal or banking information in response to suspicious requests.

The attack highlights the growing risks faced by organisations holding large volumes of passenger data as cybercriminals increasingly target interconnected digital systems.