● Covered by 1 source · 1 reportHigh impact1 negative
220 Million Traveler Records Exposed in Vietnam-Linked APIS Leak
Key points
- Over 220 million passenger and crew records exposed.
- Data includes passport numbers, flight details, and personal information.
- Exposure spans January 2017 to April 2026.
- Database linked to a Vietnamese organization, hosted in Hanoi.
Massive Data Exposure Discovered
A database associated with an Advance Passenger Information System (APIS) was found to be publicly accessible online due to a series of security misconfigurations. This exposed database contained more than 220 million records belonging to airline passengers and crew members.
Scope of Exposed Information
The exposed data includes sensitive personal details such as names, dates of birth, nationalities, passport numbers, document expiration dates, and issuing countries. Additionally, flight-related information like flight numbers, dates, airlines, departure/destination airports, seat assignments, and baggage references were also compromised. The records cover a period from January 2017 to April 2026.
Discovery and Origin
Kinryū Labs discovered the Elasticsearch cluster, named 'pax-info', on June 3 during research into ransomware activity. The cluster, totaling 107 GB, contained 210,318,069 passenger records and 10,465,631 crew records. Researchers confirmed the data's legitimacy by cross-referencing it with their own travel information. The database appears linked to a Vietnamese organization, hosted within Viettel-assigned IP space in Hanoi.
Potential Impact on Travelers
The exposed records could affect travelers of numerous nationalities who flew to, from, or through Vietnam during the nine-year period. While the figures represent travel records rather than unique individuals, the sheer volume and sensitive nature of the data present a significant privacy and security risk for millions of people globally.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
An Advance Passenger Information System (APIS) database, containing over 220 million passenger and crew records, was publicly accessible due to security misconfigurations. This exposure includes passport numbers and flight details for travelers to, from, or through Vietnam from 2017 to 2026, posing a significant privacy risk for a large number of individuals.