Table of Contents
Introduction
A massive Advance Passenger Information System (APIS) database has been exposed, leaking 220 million passenger and crew records spanning nine years of travel data. The exposed system appears linked to a Vietnamese organization and includes passport numbers, flight details, and personal information of travelers from around the world.
Researchers at Kinryū Labs discovered the Elasticsearch cluster on June 3, 2026, and found that it contained 107 GB of data with records dating from January 2017 to April 2026.
220 million passenger and crew records — including passport numbers, flight details, and personal information — were exposed for over nine years in a massive APIS data leak linked to a Vietnamese organization.
What Is APIS?
Advance Passenger Information Systems (APIS) are used worldwide to collect identity, passport, and flight information from airlines before passengers and crew arrive at or depart from a country.
Key functions of APIS:
- Collects passenger and crew identity information
- Captures passport and travel document details
- Transmits flight and itinerary data to border control authorities
- Used by immigration and customs agencies for security screening
APIS systems are used by governments worldwide to screen travelers before they arrive, enhancing border security and immigration control.
The Exposed Data — 220 Million Records
Kinryū Labs discovered the Elasticsearch cluster, named 'pax-info', while surveying exposed databases as part of research into ransomware activity.
Key statistics:
- Total records: 220,783,700 entries
- Passenger records: 210,318,069
- Crew records: 10,465,631
- Data size: 107 GB
- Indices: 29
- Time span: January 2017 to April 2026 (9+ years)
Database details:
- Cluster name: 'pax-info'
- Host location: Viettel-assigned IP space in Hanoi, Vietnam
- Data volume: 107 GB
- Record count: 220.7 million
What Information Was Exposed?
The exposed database contained highly sensitive personal and travel information:
- Passenger and crew names — full names of travelers
- Dates of birth — date of birth of each traveler
- Sex and nationality — gender and country of citizenship
- Passport numbers — passport or travel-document numbers
- Document expiration dates — when passports expire
- Issuing countries — countries that issued the travel documents
- Flight numbers and dates — specific flights taken
- Airlines — airlines operating the flights
- Departure, destination, and transit airports — travel routes
- Seat assignments — seat numbers on flights
- Baggage references — baggage tracking information
- Flight times — scheduled, estimated, and actual flight times
The exposed data includes passport numbers, flight details, and personal information — exactly the type of data identity thieves and fraudsters seek.
Who Was Affected?
The exposed records could involve travelers of many nationalities who flew to, from, or through Vietnam during the nine-year period.
Nationalities identified in sample records:
- Korean
- Chinese
- Canadian
- New Zealand
- And many other nationalities
Airlines represented:
- Numerous international airlines across Asia-Pacific
- European carriers
- Middle Eastern airlines
The exposed records could relate to people from virtually anywhere who visited or transited through Vietnam over the nine-year period. The figures represent travel records rather than unique individuals — passengers and crew members who flew multiple times may appear repeatedly.
How the Exposure Happened
Kinryū Labs reached the database by chaining two misconfigurations:
- Initial endpoint — From the open internet, the endpoint returned an HTTP 401 "Unauthorized" response, preventing direct access
- Cloud-based path — A cloud-based path enabled researchers to reach the cluster
- Default credentials — The cluster accepted default credentials
Exposure timeline:
- October 2022 — FOFA first recorded the host and port
- July 2023 — FOFA identified the service as a database
- Unknown — When the passenger data first became retrievable through the second access path
The actual length of the exposure is unknown. While the records span nine years, it's unclear how long the database was accessible through the cloud-based path.
Response and Remediation Timeline
Key response dates:
- June 3, 2026 — Kinryū Labs discovered the exposed database
- June 3, 2026 — Researchers reported the issue to Vietnamese authorities, airlines, and national CERTs
- June 8, 2026 — Access to the database was remediated
Singapore Airlines' role:
- Singapore Airlines' security team helped coordinate the response
- Informed Kinryū Labs on June 8 that it had "engaged the relevant parties"
- Taken steps to contain the issue
Singapore Airlines confirmed it had "engaged the relevant parties" and "taken steps to contain the issue." However, there is no indication that the airlines operated the exposed system or that their own networks were compromised.
Risks for Affected Travelers
The exposure of such sensitive data creates significant risks:
- Identity theft — Passport numbers and personal details can be used to steal identities
- Fraudulent travel — Stolen passport data could be used for illegal travel
- Spear-phishing — Attackers could use travel history to craft convincing phishing emails
- Financial fraud — Combined with other data, could enable financial crimes
- Corporate espionage — Travel patterns of executives could be exploited
- Stalking and harassment — Location data could be misused
It remains unclear whether the database was downloaded, sold, ransomed, or otherwise exploited by malicious actors before it was secured. Without access to server logs, researchers could not conclusively determine whether anyone had copied the data.
How to Protect Yourself
If you traveled to, from, or through Vietnam between 2017 and 2026, take these steps:
1. Monitor Your Credit Reports
- Check your credit reports regularly for unauthorized activity
- Consider placing a fraud alert or credit freeze
- Monitor for new accounts opened in your name
2. Be Vigilant Against Phishing
- Be suspicious of emails referencing your travel history
- Verify sender identity before clicking links
- Do not provide personal information in response to unsolicited emails
3. Monitor Your Passport Status
- If your passport was included, monitor for suspicious activity
- Consider reporting your passport as potentially compromised
- Check with your country's passport authority for guidance
4. Watch for Fraudulent Activity
- Monitor bank and credit card statements
- Watch for unauthorized travel bookings
- Be alert for any suspicious use of your identity
5. Use Identity Theft Protection
- Consider identity theft monitoring services
- Enable two-factor authentication where possible
- Use strong, unique passwords
Taking these steps can help protect you from the potential consequences of this massive data leak.
Final Thoughts
The exposure of 220 million traveler records is one of the largest data breaches involving travel and passport information ever discovered. The fact that the database was accessible through a cloud-based path with default credentials highlights critical failures in security configuration.
Key takeaways:
- 220 million records — passenger and crew data exposed
- 9+ years — records span January 2017 to April 2026
- Passport numbers — sensitive identity documents exposed
- Global impact — travelers from virtually every nationality affected
- Misconfigurations — chained cloud and endpoint misconfigurations enabled access
- Unknown exposure duration — data may have been accessible for years
- Remediated — access was secured on June 8, 2026
If you need assistance with data breach response, identity protection, or security assessments for your organization, contact SystemLogicIT for expert guidance.