An exposed cloud database has handed researchers, and potentially anyone else who found it first, nine years of airline passenger and crew records tied to travel through Vietnam. The tally: 220,783,700 entries, a figure large enough to rank among the biggest travel-data exposures ever documented — nearly 40 times the scale of the 5.7 million customer records Qantas confirmed exposed in a July 2025 call-center attack, a breach Cybersecurity Dive reported also included 4 million names and email addresses, 2.8 million frequent-flyer numbers, and 1.7 million additional contact-detail records — and it was sitting behind nothing more than a set of default login credentials.
Security firm Kinryū Labs disclosed the find to TechRadar and BleepingComputer on September 8, 2026, describing an Advance Passenger Information System (APIS) database that had been reachable through a chain of misconfigurations. BleepingComputer’s own September 2026 reporting put the tally at more than 220 million passenger and crew records and explicitly flagged passport numbers as among the exposed fields. The database, an Elasticsearch cluster the researchers found labeled “pax-info,” held passport numbers, dates of birth, nationalities, flight numbers, seat assignments, and other travel details for people who flew to, from, or through Vietnam between January 2017 and April 2026.
No airline or government agency has been confirmed as the operator of the exposed system. What is confirmed is the scale: two indices inside a 29-index, roughly 107 GB cluster held 210,318,069 passenger records and 10,465,631 crew records, a combined 220,783,700 entries that Tech Insider was among the first outlets to report in September 2026 — more than ten times the 21,292,179 email addresses Iberia disclosed were exposed in a separate breach, which DataBreach.com reported in December 2025 also exposed 237,401 phone numbers. That is not 220 million people. Passengers and crew who flew multiple times during the nine-year window appear more than once, so the real number of affected individuals is smaller than the headline figure, though still likely in the tens of millions.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What was actually exposed in the airline data breach
The exposed fields go well beyond a typical loyalty-program leak. According to the researchers’ findings, the database contained full names, dates of birth, sex, nationalities, passport or travel-document numbers, document expiration dates, and issuing countries for both passengers and crew. Attached to each record was flight-level detail: flight numbers and dates, airline names, departure, destination, and transit airports, seat assignments, baggage references, and scheduled, estimated, and actual flight times.
That combination, passport number plus travel itinerary plus date of birth, is close to a complete identity-and-movement profile. It’s the kind of dataset that immigration and border systems use to pre-screen arriving passengers, which is exactly what an Advance Passenger Information System is designed to do: airlines transmit passenger manifests to destination-country border authorities before a flight lands, so officials can flag people of interest ahead of arrival. When that pipeline itself gets exposed, the leak carries more weight than a retail loyalty database because it sits closer to government screening infrastructure.
Reviewers who examined sample records found travelers of Korean, Chinese, Canadian, and New Zealand nationality among the entries, and the researchers said the data touched airlines across the Asia-Pacific, European, and Middle Eastern markets. Because APIS records are collected for anyone entering or transiting a country, the practical reach of a nine-year Vietnam-linked archive extends to travelers from dozens of countries who may never have realized their passport data was retained this long, let alone stored on a database anyone could reach with a guessed password.
How researchers found the database
Kinryū Labs said it came across the cluster on June 3, 2026, while running routine surveys of exposed databases as part of broader research into ransomware activity, not while specifically hunting for airline data. The path to the records involved two separate misconfigurations layered on top of each other. A direct request to the exposed endpoint from the open internet returned an HTTP 401 “Unauthorized” response, which would normally have blocked casual access. But a second, cloud-based route around that block led to the same cluster, and once researchers reached it through that path, the system accepted default credentials.
That is a familiar failure pattern in cloud security: a service that looks locked down from one angle turns out to have a side door that was never hardened. Internet-scanning platform FOFA had recorded the host and port as far back as October 2022 and flagged it as a database as early as July 2023, evidence that the underlying server had been internet-facing for years before anyone reported the exposure. What the researchers could not determine is when the passenger data itself became retrievable through the second, unprotected path. The records span more than nine years, but the actual duration of public exposure remains unknown, which is a distinction that matters a great deal for anyone trying to gauge real-world risk.
Kinryū Labs said it verified the data’s authenticity by cross-checking entries against its own researchers’ documented travel to Vietnam, a common but effective validation step in exposed-database research: if your own trip shows up correctly in someone else’s leaked spreadsheet, the dataset is real.
Timeline: from discovery to remediation
The gap between discovery and lockdown was short by industry standards. Kinryū Labs said it began notifying Vietnamese authorities, the airlines whose passenger records appeared in the database, and national computer emergency response teams starting June 3, 2026, the same day it found the cluster. Access to the database was cut off five days later, on June 8, 2026.
| Date | Event |
|---|---|
| January 2017 | Earliest passenger and crew records in the exposed dataset |
| October 2022 | FOFA scanning platform first records the exposed host and port |
| July 2023 | FOFA identifies the exposed service as a database |
| April 2026 | Latest passenger and crew records in the exposed dataset |
| June 3, 2026 | Kinryū Labs discovers the “pax-info” cluster; begins notifying authorities, airlines, and CERTs |
| June 8, 2026 | Access to the database is remediated; Singapore Airlines’ security team confirms it “engaged the relevant parties” |
| September 8, 2026 | Findings published by BleepingComputer and TechRadar |
Two months passed between remediation and public disclosure, a gap that’s fairly typical for coordinated vulnerability reporting, giving affected organizations time to investigate and, ideally, notify people whose records were exposed before the story becomes public. Whether any of the airlines or governments involved actually notified affected travelers directly has not been confirmed.
Singapore Airlines and Changi Airport’s role in the response
Singapore Airlines was not identified as the owner of the exposed system, but its security team stepped into a coordinating role once notified. An email reviewed by BleepingComputer showed the carrier’s security team telling Kinryū Labs on June 8 that it had “engaged the relevant parties” and “taken steps to contain the issue.” Singapore Airlines did not provide further comment beyond that.
Changi Airport Group, which manages and operates Singapore’s Changi Airport, told BleepingComputer it had investigated the matter but declined to comment further. The researchers’ findings identified passenger records from several major airlines inside the database, but there is no indication that any of those airlines operated the exposed system themselves or that their own internal networks were breached. In other words, the airlines appear to be data subjects in this exposure, not the source of the leak. Reporters also contacted Vietnamese authorities well ahead of publication but received no response.
Was the data stolen, sold, or exploited?
This is the question every reader wants answered, and it’s the one nobody can answer with certainty yet. Kinryū Labs said it found no ransom notes and no unfamiliar indices added to the cluster, and it could not locate the dataset for sale on any dark-web or criminal marketplace it checked. Without access to the server’s access logs, though, the researchers said they could not conclusively determine whether anyone else had already copied the data before they found it.
That “unknown” is the uncomfortable middle ground that defines most misconfigured-database stories. A locked-down database with no evidence of malicious access sounds reassuring, but the absence of a for-sale listing doesn’t mean the absence of a copy sitting quietly on someone’s drive. Given that FOFA indexed this specific host as an exposed database back in July 2023, nearly three years before the September 2026 disclosure, the exposure window was long enough that treating this as a low-risk event would be premature.
Why Advance Passenger Information Systems are a high-value target
APIS pipelines sit at the intersection of aviation, border security, and law enforcement, which makes them structurally different from ordinary corporate customer databases. Airlines are required to transmit passenger and crew manifests, including passport data, to destination-country authorities ahead of arrival so that immigration and security agencies can screen travelers before they land. That data typically flows through a chain of systems: airline reservation platforms, government border-control interfaces, and, in many cases, third-party integration layers that translate between the two.
Any one of those links can become a weak point. A misconfigured cloud instance holding APIS data is arguably more dangerous than a leaked airline loyalty database because it aggregates data from many carriers into a single record set tied to a specific destination country’s border checkpoints. For a threat actor building profiles for identity fraud, visa fraud, or targeted phishing against frequent international travelers, a nine-year archive of passport numbers cross-referenced with real flight histories is a far richer resource than a one-time snapshot of frequent-flyer numbers and email addresses.
How this compares to other 2026 breaches involving travel and identity data
This is not an isolated event in 2026’s breach landscape, and the pattern stretches back well into the prior year. The ransomware group Everest claimed in October 2025 to have stolen 1,533,900 records from Dublin Airport, according to Bitdefender’s reporting, one of several aviation-sector claims the group made that same month. The year has already produced a string of large-scale identity-document exposures, and the Vietnam-linked APIS leak fits a pattern that has repeated across several sectors: sensitive government-adjacent identity data sitting in cloud infrastructure that nobody was actively monitoring.
| Incident | Records exposed | Data type | Root cause |
|---|---|---|---|
| Vietnam-linked APIS leak (Sept. 2026) | 220,783,700 | Passport numbers, flight history, DOB, nationality | Chained cloud misconfiguration, default credentials |
| IDScan.net / Nexus breach (2026) | 153 million IDs | Scanned driver’s licenses and ID documents | Third-party ID-verification vendor compromise |
| McKesson breach (2026) | 284 million records | Healthcare and personal records | Ransomware, extortion demand |
| Mathspace breach (2026) | 1.08 million users | Student personal data (AU, NZ) | Under investigation |
| Thomson Reuters C-Track breach (2026) | Multi-state court records | Court case and filing data | Under investigation |
The common thread across these incidents, and the reason the Vietnam APIS leak deserves attention beyond a one-day headline, is that the underlying data types (passport numbers, driver’s license scans, court records, healthcare files) are largely immutable. A leaked credit card can be canceled and reissued in a week. A passport number tied to a document that’s valid for ten years, cross-referenced against real travel history, is a durable asset for anyone building long-term fraud or surveillance capability. Workforce data is proving just as attractive to the same actors: Everest also claimed in October 2025 to have obtained data belonging to 18,000 Air Arabia employees, per Bitdefender, a reminder that aviation-sector breaches aren’t limited to passengers. The IDScan.net breach that exposed 153 million ID documents and the McKesson breach affecting 284 million records followed a similar arc: quiet discovery, delayed disclosure, and lingering uncertainty about whether attackers got there first.
The historical pattern: misconfigured cloud databases keep happening
This story sits within a broader wave of 2026 cybersecurity threats tracking government-adjacent identity data. Exposed Elasticsearch, MongoDB, and cloud storage instances have been one of the most consistent sources of large-scale data leaks for the better part of a decade. What makes the current incident notable isn’t the discovery method, chained misconfigurations and default credentials are a well-worn story, but the sensitivity and durability of the specific data type involved. Verizon’s long-running Data Breach Investigations Report series has repeatedly flagged misconfiguration and credential weaknesses as recurring root causes across breach types, and IBM’s Cost of a Data Breach research has tracked how breaches involving customer personal data tend to carry higher downstream remediation costs than breaches limited to internal or operational data.
What has changed over the past two years is the sheer scale at which a single misconfigured cluster can now aggregate data. Cloud-native databases make it trivial to centralize nine years of records from multiple source systems into one searchable index. That’s convenient for operational purposes and catastrophic when the access controls guarding it are an afterthought.
What travelers whose data may be affected should do
There is no public tool yet that lets an individual traveler check whether their specific record was inside the “pax-info” cluster, and Kinryū Labs has not published a searchable lookup. Services like Have I Been Pwned track many breaches but would only reflect this incident if the underlying dataset is formally added following further disclosure. In the meantime, security guidance for anyone who traveled to, from, or through Vietnam between 2017 and 2026 follows the same playbook as other passport-data exposures:
- Watch for phishing attempts that reference real flight details, dates, or destinations, since accurate itinerary data makes social-engineering messages far more convincing.
- Monitor for unexpected visa or travel-document applications filed in your name, particularly if you hold a passport from a country with high-value travel documents.
- Check whether your passport issuer offers any breach-notification or monitoring service, since passport numbers cannot be changed as easily as a credit card number.
- Be skeptical of unsolicited contact claiming to be from an airline or border authority asking you to “verify” travel information following this news.
Market and regulatory impact
No regulator has publicly announced an investigation or enforcement action tied to this specific exposure as of publication, though US authorities have moved quickly on comparably sized identity leaks this year, including the FBI probe opened into a 153-million driver’s-license exposure. Regulators elsewhere are already moving on adjacent, airline-linked incidents: UPI reported in September 2026 that Mexico’s government opened a probe into Aeroméxico over an alleged leak involving more than 15 million passenger records, underscoring how quickly aviation-data exposures are drawing formal scrutiny. That precedent suggests the Vietnam-linked APIS leak could change quickly given its own scope: a nine-year, multi-nationality dataset touching airlines across Asia-Pacific, Europe, and the Middle East is the kind of incident that tends to draw attention from data-protection authorities in whichever jurisdictions determine their citizens’ data was included, particularly under frameworks like the EU’s General Data Protection Regulation, which imposes notification obligations on organizations handling EU residents’ personal data regardless of where the breached system is physically hosted.
For the aviation and travel-tech sector, incidents like this typically translate into renewed scrutiny of third-party data-sharing arrangements. Airlines routinely hand passenger manifests to government systems and to intermediary vendors that process APIS submissions, and each handoff point is a potential exposure. Expect airline IT security teams and aviation-data vendors to face fresh questions from customers, insurers, and regulators about who else holds copies of their APIS submissions and how those copies are secured — scrutiny that’s already playing out at carriers like Qantas, where TechCrunch reported the breach ultimately affected roughly 6 million passengers after a June 30, 2025 call-center attack that exposed customer dates of birth alongside the 2.8 million frequent-flyer numbers Cybersecurity Dive detailed in its own July 2025 reporting, a concern that echoes the fallout from the airports hack that exposed data on 8.7 million people earlier this year.
What we still don’t know
Several key facts remain unconfirmed. No organization has been publicly named as the operator of the exposed “pax-info” cluster; BleepingComputer said it could not confirm which Vietnamese organization ran the system, and Vietnamese authorities did not respond to inquiries ahead of publication. The closest the reporting came to a geographic anchor was the observation that the exposed host sat in IP address space assigned to Vietnamese state telecom Viettel in Hanoi, though researchers cautioned that an IP-space assignment identifies where a server was hosted, not who operated or owned the data on it. The exact duration of the exposure is unknown, since researchers could establish only that the underlying host was visible to internet scanners since 2022 and flagged as a database since 2023, not when the passenger data itself became reachable. And whether anyone accessed or copied the data before Kinryū Labs’ discovery cannot currently be proven or ruled out, since the researchers lacked access to server logs.
Kinryū Labs said it expects to publish additional technical findings on its own blog later in the week following the initial disclosure, which may fill in some of these gaps, including more detail on the specific misconfiguration chain and possibly a clearer picture of which organization was ultimately responsible for the database.
Predictions: where this story goes next
Based on how similar large-scale identity exposures have played out in 2026, a few outcomes look likely in the weeks ahead.
- A named operator will likely surface. Given that FOFA had the host indexed since 2022 and airlines were reachable enough to coordinate a response within five days, further reporting or Kinryū Labs’ follow-up post is likely to identify the specific Vietnamese entity, government agency, vendor, or contractor, that operated the “pax-info” cluster.
- At least one data-protection regulator opens an inquiry. With EU, UK, Canadian, Korean, Chinese, and New Zealand nationals confirmed among the sample records, it would be unusual for every relevant privacy authority to stay silent on a breach of this scale.
- Airlines named in the dataset will face customer and press inquiries about whether they were notified, even though none of them appear to have operated the exposed system themselves.
- Class-action interest will follow the pattern of 2026’s other mega-breaches, including the ShinyHunters DMV extortion campaign, if any US, EU, or Australian residents can be shown to be included and a responsible commercial entity is identified.
- Security vendors and cloud providers will use this incident as a fresh example in pitches around Elasticsearch and cloud-database hardening, credential rotation, and exposure-management tooling, much as previous large exposed-database stories have been cited in vendor marketing throughout 2025 and 2026.
The technical failure, explained simply
For readers less familiar with database security, it’s worth unpacking what “chained misconfiguration” actually means here. Elasticsearch, the technology underlying the exposed cluster, is an open-source search and analytics engine widely used to index and query large volumes of structured data quickly. Out of the box, older or poorly configured Elasticsearch deployments have a long history of shipping without authentication enabled by default, a problem Elastic, the company behind the software, has spent years pushing customers to fix through security defaults and hardening guides.
In this case, the front door, a direct connection attempt, was locked (the HTTP 401 response). But a second access path, reachable through cloud infrastructure rather than the open internet directly, was not locked the same way, and it still accepted default, out-of-the-box login credentials that were apparently never changed after deployment. That’s the “chain”: two separate configuration failures that individually might have been harmless, but combined to expose the entire dataset to anyone who found the second path and tried the default password.
Frequently asked questions
How many records were exposed in the airline data breach?
Researchers at Kinryū Labs found 220,783,700 combined entries, made up of 210,318,069 passenger records and 10,465,631 crew records, inside an exposed Elasticsearch cluster after discovering it in June 2026.
What time period does the leaked data cover?
The records span January 2017 through April 2026, roughly nine years of passenger and crew travel history, a date range TechRadar independently confirmed in its September 2026 reporting on the exposure.
Which airline or company owned the exposed database?
As of publication, no airline or organization has been publicly confirmed as the operator of the database. Reporters could not confirm which Vietnamese organization ran the system, and Vietnamese authorities did not respond to inquiries.
Was Singapore Airlines the company that got breached?
No. Singapore Airlines was not identified as the operator of the exposed system. Its security team helped coordinate the response after being notified, telling researchers it had “engaged the relevant parties” and “taken steps to contain the issue.”
Was the exposed data stolen or sold?
Researchers found no ransom notes and no evidence of the dataset being offered for sale, but without access to server logs they could not rule out that someone else accessed or copied the data before it was secured.
How was the database secured, and how quickly?
Kinryū Labs discovered the database on June 3, 2026, and began notifying Vietnamese authorities, affected airlines, and national CERTs the same day. Access was remediated on June 8, 2026, five days later.
What kind of data does an Advance Passenger Information System store?
APIS databases collect identity, passport, and flight information that airlines transmit to destination-country border authorities before passengers and crew arrive, typically including passport numbers, dates of birth, nationalities, and flight itineraries.
What should travelers do if they flew to or through Vietnam between 2017 and 2026?
Watch for phishing messages referencing real travel details, monitor for unexpected visa or travel-document activity, check with your passport issuer about breach-notification options, and treat unsolicited “verification” requests referencing this news with suspicion.
