A security research team uncovered one of the largest caches of passenger information in recent memory. Over 220 million records from an Advance Passenger Information System sat exposed for years. The data included names, passport numbers, birth dates and complete flight itineraries for travelers moving to, from or through Vietnam.
Unchecked Access to a Critical Border System
Kinryū Labs found the Elasticsearch cluster on June 3, 2026. Researchers were scanning for exposed databases tied to ransomware campaigns. They located a system named ‘pax-info’ hosted in IP space assigned to Viettel in Hanoi. The cluster held 29 indices and roughly 107 GB of data. Two main indices contained 210,318,069 passenger records and 10,465,631 crew records. Total: 220,783,700 entries. Spanning January 2017 to April 2026.
Access wasn’t direct from the public internet. But a chain of misconfigurations opened a cloud-based path. Default credentials worked. Once inside, the full archive became readable. Names. Dates of birth. Sex. Nationalities. Passport or travel document numbers. Expiration dates. Issuing countries. And then the travel specifics: flight numbers, airlines, departure and arrival airports, transit points, seat assignments, baggage references, scheduled times, estimated times, actual times.
But the exposure ran longer than anyone first realized. Internet scanning service FOFA spotted the host as early as 2022 and flagged it as a database in 2023. Nearly four years of unnoticed risk. The records weren’t limited to Vietnamese citizens. International travelers from many countries appeared repeatedly if they flew multiple times. One person. Multiple entries. A rich profile for anyone seeking to build dossiers.
Advance Passenger Information Systems feed border authorities worldwide before flights depart. Airlines transmit the data as a standard requirement. Governments use it for security screening, immigration control and counterterrorism. When that feed leaks, the consequences stretch far beyond one database. Identity thieves gain fresh passport details. Fraudsters can craft convincing travel histories. State actors could map movement patterns of specific nationalities or frequent routes.
Singapore Airlines’ security team stepped in to coordinate the response. An authenticated email reviewed by BleepingComputer shows the carrier informed Kinryū Labs on June 8 that it had “engaged the relevant parties” and “taken steps to contain the issue.” The cluster was locked down that same day. No evidence has surfaced of the data appearing for sale on dark web markets. Yet the absence of a listing doesn’t equal safety. Data this detailed moves quietly among sophisticated actors.
This incident arrives amid a string of airline and airport compromises. Just days earlier, criminals published personal data of 8.7 million people after breaching Manchester Airports Group, according to a BBC News report. That leak included contact details, vehicle registrations and postcodes pulled from wi-fi and parking systems. Hackers offered the full set for free to other criminals. The pattern feels familiar. Travel infrastructure holds valuable personal data. Defenses often lag.
Earlier this year, Frontier Airlines faced accusations that a flaw in its boarding pass system exposed passport numbers, addresses and payment details for months. Other carriers including Qantas, WestJet and Uzbekistan Airways reported significant incidents in 2025. Each case reveals different weaknesses. Some involve third-party vendors. Others stem from legacy systems or unpatched vulnerabilities. The common thread? Passenger trust erodes with every headline.
Kinryū Labs chose responsible disclosure. The team didn’t publish samples that could accelerate harm. They worked through channels until the database was secured. Their restraint stands in contrast to opportunistic actors who leak first and ask questions later. Still, the sheer volume raises hard questions for airlines, governments and the vendors who manage APIS deployments.
Who operated this particular system remains unclear. TechRadar noted that researchers could tie it only to Viettel’s IP space in Vietnam’s capital. No Vietnamese organization has publicly claimed ownership. No airline has issued mass notifications. The data’s multinational character complicates accountability. A European traveler flying through Hanoi might never learn their record was exposed. Notification requirements vary by country and by whether the operator qualifies as a data controller under local law.
The risks compound. Passport numbers don’t expire quickly. Combined with names, birth dates and travel patterns, they enable synthetic identity fraud, account takeovers and targeted phishing. Criminals could impersonate frequent flyers to bypass security questions. Or sell packages of “verified” traveler data to others. Border agencies might now face questions about whether compromised records have already tainted watch lists or risk assessments.
So the discovery forces a wider conversation. APIS data was designed for controlled, time-limited sharing between airlines and governments. When that data escapes into an unsecured Elasticsearch instance, the original design fails. Default credentials. Open cloud paths. Years of undetected exposure. These aren’t exotic attack techniques. They represent basic hygiene gaps in systems that handle some of the most sensitive movement data on the planet.
Travelers cannot easily opt out of APIS collection. Governments mandate it. Airlines comply. The burden of protection therefore falls on the operators. This case shows how a single misconfigured cluster can undermine years of border security cooperation. And while the database is now locked, the copies made during its long exposure cannot be recalled.
Industry insiders will watch closely for follow-on activity. No dark web sale has been confirmed. But absence of evidence is not evidence of absence. Sophisticated groups often sit on high-quality datasets rather than flood markets. The real test will come in the months ahead as fraud patterns potentially shift. For millions of travelers whose records crossed this system, the exposure may only become visible when something goes wrong.