More than 220 million traveler records linked to Vietnam exposed online
A passenger information system database, apparently linked to a Vietnamese organisation, was left reachable from the internet with passport and flight data.
What happened
An Advance Passenger Information System (APIS) database holding more than 220 million passenger and crew records was reachable from the internet through a chain of security misconfigurations, according to BleepingComputer. The cluster, about 107 GB across 29 indices, covered January 2017 to April 2026 and included names, dates of birth, nationalities, passport numbers and flight details. The researchers who found it linked it to a Vietnamese organisation; the outlet could not confirm which one.
Why it matters
It lets identity be matched to travel, which is exactly what fraudsters and targeted attackers want. These are records, not people: the 220 million entries span nine years of passengers and crew across airlines from several regions.
What we recommend
Review which databases and APIs you expose to the internet and with which credentials; remove default credentials; and, if your executives travel often, treat messages quoting real flight details with suspicion — they are building credibility.
Related service: Executive digital protection
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.