Vietnam's Border Database Leaked 220 Million Passport Records
A border-control database holding 220 million traveler records sat reachable on the internet, and the Vietnam APIS leak turned out to contain the part of a trip nobody chooses to share: passport numbers, dates of birth, nationalities, and the full flight history behind them. Kinryū Labs found the cluster on 3 June 2026, and the operator closed it five days later. What nobody can say is how long it had been open before that, or who else walked in.
The short version
- An Elasticsearch cluster named pax-info held 210,318,069 passenger records and 10,465,631 crew records, 220,783,700 in total.
- The data covers January 2017 to April 2026 and travel to, from, or through Vietnam, so nationality is no protection.
- Direct access was blocked, but a cloud path reached the same cluster and accepted default credentials.
- There are no server logs, so nobody can prove the database was not copied.
What was in the Vietnam APIS database
The cluster ran 29 indices and roughly 107 GB of data on IP space assigned to Viettel in Hanoi. Two indices carried the weight: one for passengers, one for crew. Each record pairs an identity with an itinerary. On the identity side there are names, dates of birth, sex, nationality, passport or travel-document number, the document's expiry date and issuing country. On the travel side there are flight numbers and dates, airlines, departure, destination and transit airports, seat assignments, baggage references, and scheduled, estimated and actual times.
That pairing is what makes this different from an ordinary customer leak. A marketing database tells an attacker who you are. This one tells them who you are, which document you travel on, when it expires, where you went, who you likely sat next to, and how often you make the trip. Kinryū Labs says it confirmed the records were real by looking up its own researchers' travel to Vietnam and finding it in the cluster.
How the door was left open
Nothing exotic happened here. Hitting the cluster directly over the internet returned an HTTP 401, which is what a system administrator would check and consider settled. A second route, a cloud-based path to the same cluster, was never hardened, and it accepted default credentials. Two ordinary misconfigurations chained together turn a locked front door into an unlocked side entrance, and the front door still reports that everything is fine.
The host itself was not new. The internet scanning platform FOFA recorded it in October 2022 and flagged it as a database in July 2023. That does not prove the data was exposed for four years, because the credentials and the cloud path may have changed over time. It does mean the machine was visible to anyone running scans for far longer than the five days between discovery and the fix.
Why a government holds this data at all
Advance Passenger Information is not a Vietnamese invention. Under the international framework built around ICAO Annex 9, airlines transmit passenger identity and travel-document data to the destination country's border authorities before the aircraft arrives, in a standardized message format. Most countries you fly to receive a version of this file about you. The passenger has no opt-out: the alternative to handing over the data is not flying.
That is the uncomfortable part of a story like this one. The people in that cluster did not sign up for a service, agree to terms, or click a cookie banner. They bought a ticket. The system that collected their documents is mandatory, the database held nine years of history, and the security of the whole arrangement came down to whether one cluster in Hanoi had default credentials on a secondary path.
Timeline
- October 2022: the scanning platform FOFA first records the host; in July 2023 it is identified as a database.
- 3 June 2026: Kinryū Labs finds the pax-info cluster while surveying exposed databases for ransomware research, and notifies Vietnamese authorities, affected airlines and national CERTs.
- June 2026: Singapore Airlines' security team helps coordinate the response; Changi Airport Group declines to comment; the Vietnamese authorities do not reply.
- 8 June 2026: access is closed.
- 8 September 2026: the findings are published.
What a traveler can actually do
Very little, and it is better to say so plainly than to pretend otherwise. You cannot rotate a passport number the way you rotate a password, the data is nine years deep, and no consumer tool reaches inside a border-control system. What you can do is treat the leak as a lasting change to your threat model rather than a one-day headline.
- Expect convincing phishing. A message that quotes your real flight number, seat and travel dates is far more persuasive than a generic scam. Airline and immigration-themed messages asking you to confirm document details deserve zero trust, whatever they know about you.
- Watch document fraud, not card fraud. Passport numbers plus dates of birth feed identity checks and visa applications, not card charges. If your country lets you check for misuse of your travel document, that is the more relevant place to look.
- Note the expiry date. A passport that gets renewed puts a new number between you and this dataset. It is not urgent for everyone, but it is the one part of the record you can change.
And one thing that does not help: a VPN. It protects traffic between you and a server, which has nothing to do with a database your airline was legally obliged to fill in on your behalf. This leak sits in a category where the fix is a government's to make, not a subscriber's. It is worth remembering the next time a breach story arrives with a discount code attached, and it is the same pattern we saw when ShinyHunters walked off with passport data on six million cruise passengers.
