An Advance Passenger Information System (APIS) database hosted in Vietnam exposed about 220.8 million passenger and crew records. The records cover nine years of air travel to, from and through the country, from January 7, 2017 to April 30, 2026. Researchers at Kinryū Labs found the Elasticsearch cluster in June 2026. It was reachable through a cloud path that accepted default credentials. The records include names, dates of birth, nationalities and passport numbers. Korean reporting says nearly 25 million of them belong to passengers of five South Korean airlines. No operator has claimed the system. Four months after Seoul asked Hanoi for confirmation, Vietnamese authorities still describe the leak as unconfirmed, according to the Hankyoreh. No PRIMARY-tier source (victim statement, regulator filing or CERT advisory) is available. All figures below come from the researchers and press reports.
What Happened
Kinryū Labs found the cluster on June 3, 2026 while surveying exposed databases as part of research into ransomware activity (BleepingComputer, Luật Khoa). The Hankyoreh reports that the Korea Internet & Security Agency (KISA) received the researchers' report on June 4. The cluster was named "pax-info" and held 29 indices and about 107 GB of data. Kinryū Labs traced it to IP space assigned to Viettel in Hanoi. Neither BleepingComputer nor Security Affairs could confirm which Vietnamese organization ran it.
Kinryū Labs says it notified Vietnamese authorities and the affected airlines. Digital Today reports that access was blocked on June 8. The researchers went public around September 8 and 9. Digital Today's article says TechRadar reported the story on "Aug. 8", but TechRadar's own piece is dated September 8. The Digital Today date looks like an error.
The exposure may have started long before June. Luật Khoa cites Kinryū Labs as saying that FOFA, an internet asset search engine, had indexed the data source as early as October 2022. That claim comes from a single OTHER-tier source and has not been independently verified. If it is accurate, the cluster was reachable for more than three years, and nobody knows who else accessed it.
Diplomatic follow-up has been slow. The Hankyoreh reports that the Korean government asked Vietnam to confirm the breach, but that over the following four months Hanoi said only that the leak was unconfirmed. Luật Khoa reports that no Vietnamese agency or airline has taken responsibility.
What Was Taken
The two largest indices held 210,318,069 passenger records and 10,465,631 crew records, a combined 220,783,700 entries. BleepingComputer, Security Affairs, Digital Today and the Hankyoreh all give these figures. The Hankyoreh's English-language image caption says "more than 22 million records", which contradicts its own body text and appears to be a typo. These are travel records, not unique people, and frequent travelers appear many times (Security Affairs, Digital Today). The number of distinct people affected is therefore lower, but nobody has published an estimate.
Each record contains: - Identity data: full name, date of birth, sex, nationality - Document data: passport or travel-document number, expiry date, issuing country - Travel data: airline, flight number and date, departure, destination and transit airports, seat assignment, baggage reference, and scheduled, estimated and actual flight times
Reported breakdowns by airline: - Korean carriers: the Hankyoreh reports nearly 25 million records from Korean Air, Asiana Airlines, Jeju Air, Jin Air and Trinity Airways (formerly T'way Air). - Vietnamese carriers: Luật Khoa reports that VietJet Air and Vietnam Airlines account for the largest shares, at 45.8 million and 43.1 million records respectively. It also says the dataset covers 1,008 airlines. - Other nationalities: BleepingComputer saw Korean, Chinese, Canadian and New Zealand travelers in sample records. Security Affairs says airlines across Asia-Pacific, Europe and the Middle East are represented.
Kinryū Labs says it confirmed the data is real by matching records to its own researchers' trips to Vietnam (Security Affairs). TechRadar reports that the archive has been locked and that there is no evidence yet of the data being sold on the dark web.
A separate claim to keep apart: HEROIC has published a "Vietnam Airlines" breach listing of 8,084,385 records containing emails, names, phone numbers and dates of birth. Those data types do not match the APIS fields, HEROIC does not mention this cluster, and no other source links the two. Treat it as a separate, unverified dataset, not as an alternative count for this incident.
Why It Matters
Passport numbers and dates of birth cannot be changed the way a password can. Security Arsenal points out that victims cannot rotate them. This dataset links those identifiers to flight times, seats and transit points over nine years, which creates three kinds of risk:
- Intelligence collection. Multi-year travel histories for named people, including airline crew, are valuable to state actors who build profiles of officials, executives, journalists and dissidents. A dataset that tracks who flew where, when and with whom is a counterintelligence problem, not just a privacy problem.
- Fraud and social engineering. Real itineraries and booking details make convincing lures for fake airline-support calls, visa scams and identity checks with banks and telecoms.
- Accountability gap. No operator has been named, Vietnam has not confirmed the leak, and the notification process for affected people across many countries is unclear. Without a responsible party, most travelers in the dataset may never be told.
The Attack Technique
No exploit was involved. TechRadar and Digital Today describe the cluster as not directly reachable from the open internet. Researchers reached it through a separate cloud-based path, and the cluster then accepted default credentials. Luật Khoa gives the same account. Security Arsenal classifies this as CWE-1392 (Use of Default Credentials) combined with CWE-668 (Exposure of Resource to Wrong Sphere).
The researchers called the cause a "chain of security misconfigurations" (BleepingComputer). Network isolation on the main interface made the system look private. An unmanaged alternate route and an unchanged factory login undid that protection. The reported FOFA indexing from 2022 suggests the path was visible to anyone scanning for it.
What Organizations Should Do
- Remove default credentials everywhere. Audit Elasticsearch, OpenSearch, Kibana and other admin consoles for vendor-default or unchanged built-in accounts. Enforce this at deployment time, not after a review.
- Map every route to your data, not just the front door. List cloud load balancers, proxies, peering links, management endpoints and snapshot repositories. A cluster blocked on its main interface is still exposed if a side route reaches it.
- Check what scanners already see. Search Shodan, FOFA and Censys for your IP ranges and cluster names regularly. If a third-party engine indexed your asset years ago, assume someone else found it too.
- Minimize and age out regulated data. APIS data is collected for a specific border-control purpose. Nine years of retained records turned a misconfiguration into a mass exposure. Apply retention limits, and tokenize or separate document numbers from itineraries.
- Hold vendors and data processors to account. Airlines send APIS data to government and third-party systems they do not control. Contracts should require security attestations, breach notification timelines and named data owners.
- Prepare for passport-data phishing. Airlines and travel firms with customers in this dataset should warn them about scams that cite real itineraries, and tighten identity checks that rely on date of birth or passport number.
Sources: Data leak in Vietnam exposes 9 years of Korean airline passenger re... | 220 million traveler records exposed in Vietnam-linked APIS leak | Massive Vietnam-Linked APIS Database Exposes Passport and Flight Data | Massive data breach sees 220 million traveler records exposed — nin... | Records of passengers and crew travelling to and from Vietnam expos... | Vietnam Airlines Data Breach Exposes 8,084,385 Records HEROIC | Vietjet, Vietnam Airlines và nhiều hãng khác lộ 220 triệu bản ghi h... | 220 Million Traveler Records Exposed via Default Credentials on Vie...