Every international flight starts with a quiet data transfer. Airlines collect your passport number, date of birth and seat number. Then they send it all to border officials before you board. Passengers never see that handoff and cannot opt out. Researchers have now found one of those systems sitting wide open. The Vietnam APIS data leak placed more than 220 million traveler records within public reach.
What the Vietnam APIS data leak actually contained
Kinryu Labs found the exposed system on June 3. The team was surveying unsecured databases for ransomware research at the time. The cluster ran on Elasticsearch and carried the name pax-info. It held 29 separate indices and roughly 107 GB of data.
Two indices did most of the work. One stored 210,318,069 passenger records. The other held 10,465,631 crew records. That brings the combined total to 220,783,700 entries. The figure counts trips, not people, so frequent flyers appear more than once.
The records in the Vietnam APIS data leak span January 2017 through April 2026. In total, nine years of travel history sat in one place. Airlines across Asia-Pacific, Europe and the Middle East appear in the data. So the reach extends well beyond Vietnamese nationals. Anyone who flew to, from or through the country in that window may be included.
The fields that were sitting open
Each entry read like a scanned passport page stapled to a boarding pass. The identity side listed names, birth dates, sex, nationality and passport numbers. It also carried document expiry dates and issuing countries. The travel side added flight numbers, dates, airlines and seat assignments. Departure, destination and transit airports were there too, along with baggage references and flight times. Researchers matched entries against their own past trips to Vietnam to confirm the data was real.
How the database ended up online
APIS stands for Advance Passenger Information System. Governments require airlines to submit these manifests before a flight departs or lands. Border agencies then screen arrivals in advance. The model works as intended in most countries. But the data it gathers is rich, and it piles up fast.
Reaching this cluster took no real hacking. Researchers followed a cloud-based path and used default credentials that nobody had changed. One endpoint did return an HTTP 401 error. Yet a second route still served records without challenge. Small setup mistakes chained together, and the Vietnam APIS data leak grew out of that chain rather than one big flaw.
A long window of exposure
Scanning platform FOFA first logged the host and port in October 2022. By July 2023, its scans had tagged the service as a database. The Vietnam APIS data leak may therefore have been reachable for years before anyone flagged the risk.
Kinryu Labs started notifying Vietnamese authorities, affected airlines and national CERT teams on June 3. Access closed on June 8. Five days is a quick fix. But the far longer stretch beforehand is the part that matters.
Who answered and who stayed quiet
The cluster sat inside IP space assigned to Viettel in Hanoi. However, nobody has publicly confirmed who ran it. Singapore Airlines coordinated much of the response. On June 8 it said relevant parties had been engaged and containment steps taken.
Changi Airport Group looked into the matter and then declined to comment. Vietnamese authorities did not respond at all. Nothing in the Vietnam APIS data leak points to an airline breach. No evidence suggests a carrier ran the exposed system. Their passengers simply appeared inside it.
Why passport data is different from a leaked password
A stolen password costs you ten minutes and a reset. But passport numbers do not work that way. They stay valid for years. They tie straight to your legal identity. And you cannot swap one out without applying for a new document.
Add full travel history and the risk sharpens. For example, criminals use passport details for fake identities and forged documents. Flight records reveal patterns too. They show where someone lives, who they fly with, and when their home sits empty. Phishing gets far more convincing when the sender already knows your last three trips.
People caught in the Vietnam APIS data leak also have no cleanup path. They never picked the vendor. They never agreed to any terms. And they cannot ask for deletion from a system nobody has named.
What travelers can still control
A VPN cannot pull back data you handed to a border officer in 2019. That is the honest answer. Nothing about the Vietnam APIS data leak was a traveler’s fault. Still, a few habits limit what ends up in circulation next.
Treat airline emails about refunds or rebooking with suspicion, because leaked itineraries make fake messages look real. Check unexpected phone calls through the airline’s own app, even when the caller quotes your flight number. Replace a passport early if you fly often and your details show up in a confirmed leak. Use a VPN on airport and hotel Wi-Fi, since those networks are shared, noisy and rarely watched closely.
Final Thoughts
The Vietnam APIS data leak ended without a named owner and without notice to affected travelers. Server logs were missing too. So researchers could not tell if anyone copied the records before June 8. That silence is the most uncomfortable detail in the case.
Meanwhile, border data collection keeps expanding. Passengers carry the downside when storage fails. Governments ask for more information every year. The safeguards around the Vietnam APIS data leak never matched that ambition. The least they owe travelers is proof that it lands somewhere secure.
