A Nine-Year Trove of Passenger Data, Left Open
Security researchers at Kinry Labs have disclosed an exposed Advance Passenger Information System (APIS) database linked to Vietnam, holding an estimated 220 million passenger and crew records spanning nine years of travel — January 2017 through April 2026.
The exposure was an Elasticsearch cluster named "pax-info", discovered on June 3, 2026 while researchers were investigating unrelated exposed databases tied to ransomware activity. Access was gained through a chain of cloud misconfigurations, including default credentials.
Scale of the Exposure
| Metric | Detail |
|---|---|
| Cluster name | pax-info (Elasticsearch) |
| Total size | ~107 GB across 29 indices |
| Passenger records | 210,318,069 |
| Crew records | 10,465,631 |
| Time span | January 2017 – April 2026 |
| Discovery date | June 3, 2026 |
| Remediation date | June 8, 2026 |
What Was Exposed
The database contained detailed identity and travel information for individuals who traveled to, from, or through Vietnam:
- Full names and dates of birth
- Gender and nationality
- Passport or travel document numbers, expiration dates, and issuing countries
- Flight numbers, dates, and operating airlines
- Departure, destination, and transit airports
- Seat assignments and baggage references
- Scheduled, estimated, and actual flight times
This is passport-grade identity data combined with granular travel movement history — a combination that's substantially more sensitive than a typical loyalty-program or booking leak.
How It Was Accessed
Researchers reached the cluster through a cloud-based path secured with default credentials, a chain of misconfigurations rather than a single dramatic exploit. That kind of exposure — an internet-facing Elasticsearch instance with no authentication changed from its defaults — remains one of the most common root causes of large-scale data leaks, precisely because it requires no exploit development at all.
It is currently unclear whether the data was accessed maliciously or exfiltrated before the exposure was remediated on June 8, 2026.
A Separate Incident From Vietnam Airlines
This APIS leak is distinct from other recent Vietnam-related data incidents that share overlapping subject matter but different root causes and scope:
| Incident | Records | Nature |
|---|---|---|
| Vietnam-linked APIS leak (this story) | ~220 million | Exposed government-linked passenger/crew database |
| Vietnam Airlines breach | ~23 million | Airline customer data (names, email, phone, Lotusmiles numbers) |
| Vietiso travel CRM leak | ~209,000 | Travel CRM platform client records |
Reporting on breaches touching Vietnamese travelers has been frequent enough recently that it's worth double-checking which specific incident any given notification or news report refers to.
Why This Matters
Passport and travel-movement data is difficult to change once exposed — unlike a password or credit card, a passport number and travel history don't reset. Combined with dates of birth and nationality, this class of data is a common building block for identity fraud, visa fraud, and highly targeted phishing that references real travel itineraries.
For a government-linked border/immigration system specifically, an exposure of this scale also raises questions about downstream use by state and non-state actors interested in tracking individual movement patterns over nearly a decade.
Recommendations
- Travelers to/from/through Vietnam between 2017-2026 should treat their passport number and travel history as potentially exposed, even though direct notification at this scale is unlikely.
- Be alert to unusually specific phishing that references real past flights, seat numbers, or travel dates — this leak provides exactly that kind of detail to craft convincing lures.
- Cloud/database operators generally should treat this as another reminder to audit internet-facing Elasticsearch, MongoDB, and similar clusters for default or missing authentication — this remains one of the most common and most preventable root causes of mega-leaks.
- Monitor for passport fraud indicators if you believe your data may be included, such as unexpected visa or travel document activity.