An exposed passenger information database revealed more than 220 million travel records linked to passengers and airline crews. The APIS data leak included passport details, flight information and other sensitive personal data collected over nine years.
Researchers traced the system to an IP address in Hanoi, although they could not identify the Vietnamese organization responsible for operating it.
Database Contained Nine Years of Travel Data
Kinryū Labs discovered the exposed Elasticsearch cluster on June 3 while investigating databases connected to ransomware activity. The cluster carried the name “pax-info” and held approximately 107 GB of information across 29 indices.
Its two largest indices contained 210,318,069 passenger records and 10,465,631 crew records. Together, they accounted for 220,783,700 entries dating from January 2017 to April 2026.
However, that figure does not represent 220 million separate people. Passengers and crew members who traveled more than once may appear in multiple records.
The researchers found the cluster on an IP address assigned to Viettel in Hanoi. Nevertheless, they could not confirm which organization controlled the database.
Passport and Flight Details Exposed
The exposed records contained extensive personal information about passengers and crew members. This included:
- Full names
- Dates of birth
- Sex
- Nationality
- Passport or travel-document numbers
- Document expiration dates
- Issuing countries
The database also stored detailed travel information. Records included flight numbers, travel dates, airlines, seat assignments and baggage references. In addition, they listed departure, destination and transit airports alongside scheduled, estimated and actual flight times.
Samples reviewed during the investigation involved Korean, Chinese, Canadian and New Zealand travelers, among other nationalities. The wider database covered airlines operating across Asia-Pacific, Europe and the Middle East.
Therefore, the APIS data leak may affect people from many countries who entered, departed from or passed through Vietnam during the nine-year period.
Kinryū Labs confirmed that the information was genuine by comparing database entries with its researchers’ own journeys to Vietnam.
Two Security Errors Opened the Database
The database was not directly accessible through a standard internet connection. Its public endpoint returned an HTTP 401 “Unauthorized” response.
However, Kinryū Labs reached the cluster through a cloud-based route. Once connected through that second path, the database accepted default login credentials. Researchers therefore gained access by combining two separate security misconfigurations.
Internet intelligence platform FOFA first detected the host and port in October 2022. It later identified the service as a database in July 2023.
Still, researchers could not establish when the alternative access route began exposing passenger information. As a result, the records cover more than nine years, but the duration of the actual exposure remains unknown.
Researchers Reported the Exposure
Kinryū Labs began notifying Vietnamese authorities, affected airlines and national computer emergency response teams on June 3. According to the researchers, access to the database was secured on June 8.
Singapore Airlines reportedly helped coordinate the response and confirmed that relevant parties had taken containment measures. However, there is no evidence that the airlines named in the database operated the exposed system. There is also no indication that attackers compromised their internal networks.
Changi Airport Group investigated the matter but declined to provide details. Vietnamese authorities did not respond before publication.
Possible Data Theft Remains Unconfirmed
Researchers found no ransom notes, suspicious database indices or evidence that someone had advertised the information for sale. Even so, they could not rule out unauthorized access or data theft.
Without server logs, investigators cannot determine whether malicious actors downloaded, copied or exploited the records before officials secured the system.
Kinryū Labs plans to publish further technical findings about the incident.
0 responses to “Vietnam-Linked APIS Data Leak Exposes 220 Million Travel Records”