GoKawiilMisconfigured Vietnam-linked APIS database exposed 220 million traveler records
Security researchers at Kinryu Labs found an unsecured Elasticsearch cluster in Viettel-assigned IP space in Hanoi containing over 220 million passenger and crew records dating from 2017 to 2026. The exposed data included passport numbers, nationalities, dates of birth, flight details, seat assignments and baggage information, accessible due to a chain of misconfigurations and default credentials. The database was secured after being reported, though it remains unknown whether the data was accessed or copied before that point.
GoKawiil's interpretation of the reporting above, not reported fact.
Advance Passenger Information Systems handle some of the most sensitive identity and travel data governments collect, so a leak of this scale could fuel identity theft, travel fraud, or targeted surveillance across dozens of countries. The incident also highlights how airline and border-control data pipelines, often built on shared cloud infrastructure, remain vulnerable to basic configuration errors despite handling passport-level personal data.
- Over 220 million passenger and crew records were exposed via an unsecured Elasticsearch database linked to Vietnam.
- Leaked data included passport numbers, nationalities, dates of birth, and detailed flight and seating information spanning 2017-2026.
- The database was secured after disclosure, but it's unconfirmed whether the data was accessed or misused beforehand.
Zoppen RFID-Blocking Passport Holder Wallet — Stories like this leak are a reminder that your passport details are valuable data worth guarding wherever you can. A Zoppen RFID-blocking passport wallet keeps your passport, boarding passes and cards organized in one place while shielding chip-enabled documents from casual wireless skimming at crowded airports.
See Zoppen RFID-Blocking Passport Holder Wallet on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: yro.slashdot.org, 2026-09-14
Published there as: “220 Million Traveler Records Exposed In Vietnam-Linked APIS Leak”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.