220M airline passenger records exposed in Vietnam-linked database leak

A misconfigured Elasticsearch database left more than 220 million airline passenger and crew records — including passport numbers, nationalities, and detailed flight itineraries — accessible on the open internet for an unknown period before being secured in June, security researchers disclosed this week.

Kinryū Labs discovered the exposed cluster, named "pax-info," on June 3 while surveying databases as part of ransomware research, according to an exclusive report by BleepingComputer. The database contained 29 indices and roughly 107 GB of data spanning January 2017 through April 2026, drawing from an Advance Passenger Information System — the standardized data feed airlines transmit to border authorities before departure.securityaffairs+1

What Was Exposed

The two principal indices held 210,318,069 passenger records and 10,465,631 crew records, for a combined 220,783,700 entries. Exposed fields included names, dates of birth, sex, nationalities, passport or travel-document numbers with expiration dates, flight numbers and dates, airline names, departure and transit airports, seat assignments, baggage references, and scheduled, estimated, and actual flight times.thecyberexpress+1

Sample records reviewed by BleepingComputer included travelers of Korean, Chinese, Canadian, and New Zealand nationality, among others, and covered airlines across Asia-Pacific, Europe, and the Middle East. The figures represent travel records, not unique individuals, so frequent flyers may appear multiple times.bleepingcomputer+1

Chained Misconfigurations

The database was hosted on IP space assigned to Vietnamese telecommunications operator Viettel in Hanoi, though researchers could not confirm which organization operated it. Direct access returned a 401 authentication error, giving the appearance of a locked-down system, but a cloud-based path reached the same cluster and accepted default credentials.thecyberexpress+2

Internet intelligence platform FOFA first recorded the host in October 2022 and identified it as a database in July 2023, though the actual window of exposure remains unknown. Kinryū Labs reported the issue to Vietnamese authorities, affected airlines, and national CERTs on June 3; the database was secured by June 8. Singapore Airlines helped coordinate the response, informing the researchers it had "engaged the relevant parties" and "taken steps to contain the issue," according to an authenticated email reviewed by BleepingComputer.bleepingcomputer

Unanswered Questions

Researchers found no ransom notes or signs the data had been altered, but without access to server logs they could not determine whether anyone copied the records during the years the system was reachable. That distinction carries legal weight: Vietnam's Personal Data Protection Law, which took effect January 1, 2026, requires notification within 72 hours of detecting a violation and imposes fines of up to 5 percent of prior-year revenue for cross-border transfer breaches. Because the records cover international flights, EU and UK residents are almost certainly represented, potentially bringing GDPR into scope as well.securityaffairs+2