Vietnam-linked airline passenger database left open on default credentials, exposing about 220 million passport and flight records over nine years

According to BleepingComputer, an Advance Passenger Information System (APIS) database linked to a Vietnamese organization was accessible online through chained misconfigurations, holding about 220 million passenger and crew records from January 2017 to April 2026, including passport numbers and flight details ^[1]. Discoverer Kinryū Labs says the Elasticsearch cluster was reachable via a cloud path and accepted factory-default credentials; researchers began reporting on June 3 and access was fixed on June 8, but it is unknown whether anyone copied the data earlier, and the operator is unconfirmed ^[1][2]. Organizations running similar databases should change default logins and keep data ports off the public internet ^[2].

Industries mainly affected: Government, Transportation & logistics

1. Organizations running Elasticsearch or similar databases should change default logins ^[2].
2. Keep database ports off the public internet behind a network boundary .