220 million traveller records exposed in Vietnam-linked APIS leak

An Advance Passenger Information System (APIS) database holding more than 220 million passenger and crew records was left accessible online through a chain of security misconfigurations. The exposed data included passport numbers, flight details, and personal information of travellers who flew to, from, or through Vietnam between January 2017 and April 2026.

Security researchers at Kinry Labs discovered the Elasticsearch cluster, named ‘pax-info’, on June 3. It contained 29 indices and roughly 107 GB of data, with 210,318,069 passenger records and 10,465,631 crew records. The cluster was hosted in Viettel-assigned IP space in Hanoi, though the specific Vietnamese organisation operating it could not be confirmed.

Kinry Labs reached the database by chaining two misconfigurations: a cloud-based path bypassed an HTTP 401 response, and the cluster accepted default credentials. The researchers reported the issue to Vietnamese authorities, airlines, and national CERTs on June 3, and access was remediated on June 8. Singapore Airlines’ security team helped coordinate the response.

It remains unclear whether the data was downloaded or exploited before being secured. Kinry Labs found no ransom notes or evidence of the dataset being sold, but could not conclusively determine if anyone had copied the data without access to server logs.