220 Million Traveler Records Exposed in Vietnam-Linked Database Leak

More than 220 million passenger and crew records were exposed through an unsecured Advance Passenger Information System (APIS) database linked to Vietnam, potentially putting sensitive identity and travel information of people from multiple countries at risk. The database contained names, passport or travel-document numbers, dates of birth, nationalities and detailed flight information spanning January 2017 to April 2026.

Researchers from Kinryū Labs discovered the Elasticsearch database on June 3 while searching for exposed systems. The database contained about 107 GB of information across 29 indices, including 210.3 million passenger records and 10.5 million crew records. The researchers linked the server to IP address space assigned to Viettel in Hanoi, but could not determine which Vietnamese organisation operated it.

Sensitive Passport and Flight Data Exposed

The exposed information went well beyond basic passenger names. Records included sex, nationality, passport numbers, document expiry dates and issuing countries, along with flight numbers, airlines, departure and destination airports, transit airports, seat assignments and baggage references.

The database also contained scheduled, estimated and actual flight times. Researchers verified that the information was genuine by matching records against their own travel to Vietnam. Because the database counts individual travel records rather than unique people, frequent travellers may appear multiple times.

Researchers Found a Chain of Misconfigurations

The exposure was caused by multiple security weaknesses rather than a conventional network intrusion. A direct attempt to reach the database from the internet returned an HTTP 401 response, but researchers found a cloud-based route that allowed access to the Elasticsearch cluster, which then accepted default credentials.

Internet intelligence platform FOFA had recorded the host and port as early as October 2022 and identified the service as a database in July 2023. However, researchers could not determine when the passenger information itself became accessible through the alternate route.

Exposure Period Remains Unknown

The records cover more than nine years, but that does not mean the database was publicly accessible throughout that entire period. Without sufficient historical information about the misconfiguration, researchers could not establish when the sensitive data first became retrievable.

The database was secured on June 8 after the researchers reported the issue on June 3 to Vietnamese authorities, affected airlines and national computer emergency response teams. Singapore Airlines also helped coordinate the response.

No Evidence of Airline Network Breach

The discovery does not indicate that the airlines whose information appeared in the database were themselves hacked. Researchers found no evidence that the listed airlines operated the exposed system or that their internal networks had been compromised.

There was also no evidence of ransom notes or unauthorised changes to the database. However, the absence of server logs meant researchers could not determine whether someone had accessed or copied the information before the database was secured.

Why the Exposure Is Serious

The combination of passport information and detailed travel records creates risks beyond ordinary identity theft. Such data can potentially be used for targeted phishing, impersonation, social engineering and other attacks that rely on knowing where and when a person travelled.

The incident also shows how cloud-access paths and default credentials can undermine otherwise protected systems. Even when a database is not directly reachable from the public internet, an overlooked secondary access route can expose highly sensitive information if authentication and configuration controls are weak.

The scale of the exposure makes the incident particularly significant. Although the number represents travel records rather than 220 million unique individuals, the database potentially contains information about travellers and crew members from many countries who travelled to, from or through Vietnam over several years.