Changing default credentials should be a no-brainer, yet researchers still found a route into a database holding more than 220 million passenger and crew records using default login details.
Researchers from Kinryū Labs found 220,783,700 passenger and crew records in an APIS database hosted on Viettel-assigned IP space in Hanoi. The information covers more than nine years of sensitive records that could link a traveler to specific flights, dates, airports, and other journey details.
In a statement to BleepingComputer, the researchers noted that the access was possible because of a chain of configuration and authentication failures, which has now been patched. Even so, its existence underscores how simple technical workarounds can lead to significant security incidents.
For security teams, the incident shows how one overlooked endpoint can undermine the protections surrounding an otherwise restricted database and expose identity and travel data at enormous scale.
How researchers found a second route into the database
The discovery came on June 3, when researchers from Kinryū Labs identified a Vietnam-linked Elasticsearch cluster containing a database named pax-info. Accessing its direct endpoint required authentication and, per BleepingComputer, returned an HTTP 401 error.
Further investigation uncovered an alternate cloud-based path to the same cluster. According to BleepingComputer, that route accepted default credentials and gave the researchers access to the records.
The records stored there appeared to come from an Advance Passenger Information System (APIS), a system airlines use to transmit passenger and crew information to authorities before flights arrive or depart.
That purpose is what makes the exposure more serious. Instead of holding isolated pieces of personal information, the database could connect a record to a traveler’s identity, which passport they hold, where they are flying, when they are flying, and more.
What was in the database?
Kinryū Labs found 210,318,069 passenger records and 10,465,631 crew records stored between January 2017 and April 2026. That totaled 107 GB across 29 Elasticsearch indices.
According to BleepingComputer, the exposed information included names, dates of birth, sex, nationalities, passport or travel-document numbers, document expiration dates, and issuing countries.
The records also exposed flight numbers and dates, airlines, departure, destination and transit airports, seat assignments, baggage references, and scheduled, estimated, and actual flight times.
The combination matters more than any single field. A leaked passport number is already sensitive, but pairing it with a person’s date of birth, nationality, and actual travel itinerary creates a much more detailed identity and movement profile.
The records were not limited to Vietnamese travelers. Samples reviewed by BleepingComputer included travelers identified as Korean, Chinese, Canadian, and New Zealander, among other nationalities. They also noted that the exposed access was closed on June 8, following disclosure and coordination with relevant organizations.
Even so, one major question remains unanswered: whether anyone else accessed or copied the database before it was secured. The researchers found no ransom notes, unfamiliar indices, or evidence that the data was being sold, but they could not rule out unauthorized access without server logs.
What is the way forward?
The 220.8 million figure represents travel records rather than unique individuals. Passengers and crew members who traveled multiple times may appear repeatedly, although the database could still involve millions of people.
There is no confirmation that affected travelers will be contacted or offered identity-protection assistance. People who traveled to, from, or through Vietnam during the covered period may want to take additional precautions.
First, treat unexpected travel-related messages as suspicious, even when they include details that seem accurate. That includes messages or calls claiming that a flight has changed, a booking needs to be confirmed, a passport has expired, a payment has failed, or immigration documents need to be updated.
Do not use links, phone numbers, or attachments supplied in those messages to verify the claim. Instead, open the airline, travel agency, or relevant government service through its official website or app.
For businesses monitoring this development, recommended actions differ.
Do not assume everything is secure just because the most visible access point is secured. IT teams should start by understanding all assets within their organization. Audit these systems, eliminate default credentials, rotate weak or reused passwords, and verify that every endpoint enforces the same access controls.
Then test those controls as an attacker would and immediately shut down any unnecessary exposure. The goal is to make sure there is no second door into sensitive data after the first one has been locked.