Breaches Weekly, 11–17 Oct 2026: 236M Manchester Airport Rows, 66.7M Loozap Records

Also this week: Ransomware Weekly, 11–17 Oct 2026: N0n lists 19.6M Inter records while Clop’s ITK claim scores zero.

Covers leaks indexed by HaveIBeenRansom between 2026-10-11 00:00 and 2026-10-17 23:59 UTC. Each case shows when it was posted and when its data became searchable. How we pick cases, read records and score attribution: methodology.

Why these three

This edition selects three distinct eligible organisation claims, consolidating multiple Manchester Airports Group posts rather than treating each file as a separate case. The cases span airport-related files, an online marketplace and a telecom-labelled dataset. A Database World ROC post naming Manchester Airports Group leads with 236,143,952 indexed records. BFRepoV3Files posted the other two: a 66,705,950-record file labelled Loozap and a 42,123,407-record file labelled Airtel. Every selected post first appeared in 2026 and entered HIBR’s searchable index between 11 and 17 October. None is independently confirmed, so the figures describe claimed datasets as HIBR indexed them—not verified breach scope or unique affected people.

Key findings

One caveat is specific to the Manchester entry. Its public HIBR page and summary expose the record total, indexing date, JSON format and email-class ratio, but /api/fullmetadata/76fcd2200161 returned HTTP 524. We therefore leave its email count, complete domain list and attribution score unavailable rather than copying values from a related entry or estimating them.

1 · Manchester Airports Group (posted by Database World ROC)

HIBR entry: Manchester Airports Group on HaveIBeenRansom

What happened. Database World ROC posted a file named Manchester_Airports_Group_manchester.tar.7z.001 on 2 September. HIBR’s public entry says it was indexed on 15 October, inside this edition’s window. The name is a channel claim. We did not find an organisation statement or reliable outlet confirmation during collection, and the post does not by itself establish a new intrusion.

Scale. HIBR reports 236,143,952 indexed records—more than the other two selected datasets combined. The public entry shows JSON as the available file type. Because the fullmetadata request timed out, we cannot responsibly state how many source files produced that total, how many records contain emails, or whether the rows represent unique people. The number is an index count, not a victim count.

What the data contains. The exposed public metadata supports only a narrow description: JSON records and aggregate email classification. A related East Midlands-labelled entry was also indexed during the week, but it is a separate HIBR record and cannot be used to fill this file’s missing metrics. We did not access leak files or reproduce personal data.

Corporate vs Personal. The public HIBR page displays 14.11% corporate and 85.89% personal among classified email addresses. Its visible corporate leaders are btinternet.com at 27.12% and sky.com at 19.29%. Those consumer ISP domains also illustrate a classification limitation: “corporate” is a technical bucket in HIBR’s model, not a finding that those providers own the dataset.

Attribution confidence: unavailable. The v2.0 result could not be retrieved because the endpoint returned HTTP 524. A related East Midlands entry scored 27/100 (low), but scores are dataset-specific and must not be transferred. The correct analytical position is an unresolved gap, not a guessed score.

Why it stands out this week. It is the largest eligible 2026-posted dataset by a wide margin, and its personal-heavy email mix creates a broad potential phishing audience. The combination raises the priority for verification while simultaneously demanding the strongest “claimed” language.

2 · Loozap (posted by BFRepoV3Files)

HIBR entry: Loozap on HaveIBeenRansom

What happened. BFRepoV3Files posted Loozap_BF.7z on 11 September. HIBR indexed it on 16 October. Loozap is the display name derived from the file label and organisation-domain analysis; neither the channel post nor HIBR’s attribution heuristic independently confirms a breach.

Scale. The dataset contains 66,705,950 indexed records. HIBR classifies 66,705,897 as JSON and 53 as text across 90 JSON and two text source files. It identified 14,491,924 email-bearing records, equivalent to 21.73% of the total. No identity documents were classified.

What the data contains. The metadata supports JSON and text formats plus aggregate email-domain distributions. It does not safely establish names, phone numbers, passwords or listing content without a record-level review, so this edition makes no such claim. Defenders should interpret the file as a large structured dataset with a substantial contactable population, not as proof of any particular field set.

Corporate vs Personal. HIBR classifies 97.74% of email-bearing records as corporate and 2.26% as personal. Within the corporate class, fake.loozap.com accounts for 75.32% and listings360.africa for 20.13%. Those labels likely include application-generated or synthetic-looking addresses; they should not be read as 14 million employees. Gmail dominates the personal class at 84.84%.

Attribution confidence: 85/100 (high). The heuristic found that 6,887,459 of 6,901,187 effective corporate addresses mapped to the inferred loozap.com organisation domain, and organisation labels appeared in the content. Data-nature review and external corroboration were still pending, so the score supports dataset linkage, not incident confirmation.

Why it stands out this week. It combines a 66.7 million-record scale with the strongest dataset-to-announced-organisation linkage among the three breach cases. At the same time, the unusual fake.loozap.com concentration is a warning that email counts can reflect platform mechanics rather than distinct natural persons.

3 · Airtel (posted by BFRepoV3Files)

HIBR entry: Airtel on HaveIBeenRansom

What happened. BFRepoV3Files posted a file labelled 73M-Airtel.7z.001 on 23 September, and HIBR indexed it on 11 October. The file label advertises “73M,” but the indexed total is 42,123,407 records. We use the indexed figure throughout rather than repeating the channel’s filename as a measured fact.

Scale. All 42,123,407 indexed records are classified as CSV from a single source file. HIBR identified 10,704,353 email-bearing records, or 25.41% of the total. No identity documents were classified. The gap between the filename and the index total may reflect processing, deduplication or an inaccurate label; the available metadata cannot determine which.

What the data contains. The defensible content description is a large CSV with email-domain aggregates. We did not inspect raw rows, so we make no claim about phone numbers, subscriber identifiers, addresses or account status. The consumer-heavy domain mix nevertheless gives defenders a concrete abuse path to monitor: phishing, password-reset fraud and support impersonation.

Corporate vs Personal. Personal addresses account for 94.49% of email-bearing records. Gmail represents 95.32% of that class, followed by Yahoo at 2.23%. The corporate bucket is 5.51% and is led by rediffmail.com at 10.90%; several other leaders are misspellings of Gmail-like domains. That pattern argues for caution when treating technical categories as business ownership.

Attribution confidence: 55/100 (medium). The heuristic inferred airtel.com from the label and found enough supporting domain and content signals for a medium score. Only 55 points were evaluable, with data-nature review and external corroboration pending. The result makes the Airtel linkage plausible but does not verify the incident or the channel’s “73M” framing.

Why it stands out this week. It is the third-largest distinct eligible organisation claim after Manchester Airports Group and Loozap, and it presents the week’s clearest consumer-facing email risk. The mismatch between the filename and the indexed total also demonstrates why our headlines use HIBR’s measured count.

What they have in common

• Each post first appeared in 2026 and became searchable during 11–17 October, satisfying the Breaches Weekly scope without relying on historical compilations.
• All three are unconfirmed claims. HIBR metrics describe indexed material; they do not confirm who obtained it, how it was obtained or whether every record belongs to the named organisation.
• Email classification is useful for abuse planning but imperfect. Consumer ISPs, application-generated subdomains and misspelled webmail domains can distort a simple corporate-versus-personal reading.

What defenders can do

• Manchester Airports Group: monitor brand and supplier impersonation, particularly travel-notification and refund lures. Validate the dataset before notifying affected people; current public evidence does not establish unique identities.
• Loozap: review account-recovery flows, rate-limit credential and password-reset attempts, and watch for abuse involving loozap.com-labelled addresses. Separate application-generated identities from real users before measuring impact.
• Airtel: prepare fraud monitoring for SIM, billing and support-themed phishing without asserting those fields are present. Harden call-centre verification and avoid knowledge-based authentication that can be defeated with public or leaked data.
• Across all cases, require MFA, detect credential stuffing, monitor newly registered lookalike domains and give support teams a verified escalation path for users who receive convincing messages.

Is your email or phone number in one of these leaks? Check it for free · Get an alert if it shows up in a new leak

DarkEye Threat Research · Data: HaveIBeenRansom · Indexing methodology peer-reviewed in MDPI Electronics · Attribution confidence is a heuristic estimate (method v2.0), not a formal attribution.

← Previous edition · All Breaches Weekly editions