GoKawiilUnsecured Elasticsearch database exposes 220 million airline passenger records tied to Vietnam
Researchers at Kinryū Labs found an unprotected Elasticsearch cluster called 'pax-info' hosted on Viettel IP space in Hanoi, containing over 220 million passenger and crew entries spanning 2017 to 2026. The data included passport numbers, birthdates, nationalities, flight details, seat assignments and baggage references for travelers of many nationalities passing through Vietnam. BleepingComputer could not confirm exactly which organization operated the system.
GoKawiil's interpretation of the reporting above, not reported fact.
Advance Passenger Information Systems hold some of the most sensitive identity and travel data governments and airlines collect, making this exposure a serious risk for identity theft, surveillance, and cross-border fraud affecting travelers worldwide, not just Vietnamese citizens. The nine-year span of exposed records suggests the misconfiguration persisted for a long time undetected, raising questions about oversight of government-linked travel data systems.
- Over 220 million passenger and crew records were left exposed via a misconfigured Elasticsearch database.
- Data included passport numbers, nationalities, birthdates, and detailed flight information from 2017 to 2026.
- The database appears linked to a Vietnamese organization, hosted on Viettel-assigned infrastructure in Hanoi.
Zoppen RFID-Blocking Passport Holder Wallet — With passport numbers and flight details in the news, it's a good moment to tighten up your own travel document habits. This Zoppen passport wallet keeps your passport, boarding passes, and cards organized in one place with RFID-blocking material to shield chipped documents while you move through airports.
See Zoppen RFID-Blocking Passport Holder Wallet on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-08
Published there as: “220 million traveler records exposed in Vietnam-linked APIS leak”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.