A single Elasticsearch cluster named “pax-info” sat exposed on the internet for years. Inside it were more than 220 million records detailing the movements of passengers and crew who flew to, from or through Vietnam. Names. Passport numbers. Exact flight itineraries, seat assignments, baggage tags. All of it tied together in a database meant to help governments screen travelers before they ever boarded a plane.
Security researchers at Kinryū Labs stumbled across the trove on June 3, 2026. What they found stunned them. The cluster held data spanning January 2017 to April 2026. Over 210 million passenger entries. Another 10.4 million for crew. Nearly 1,000 airlines represented. And it answered to default credentials on an alternate access path.
The Discovery That Exposed a Critical Border System
Kinryū Labs had been scanning for exposed databases while investigating ransomware patterns. They located the cluster hosted in IP space assigned to Viettel, Vietnam’s largest telecom operator, in Hanoi. Direct access required authentication. But a cloud-based route did not.
The cluster was reachable through a path that still used an unchanged default login, Kinryū Labs wrote in its detailed report. The researchers pulled aggregate counts, examined the schema and verified samples against their own team’s travel records to Vietnam.
Kinryū Labs notified Vietnamese authorities, national CERT teams, and affected airlines. Access to the database was locked down by June 8. Singapore Airlines’ security team played a key role in coordinating the response, according to an authenticated email reviewed by BleepingComputer.
But the exposure had lasted far longer than anyone realized. Internet scanning service FOFA first spotted the host in 2022 and identified it as a database in 2023. How many people accessed the records in the interim remains unknown. No evidence has surfaced yet of the data for sale on dark web markets.
The information came from an Advance Passenger Information System, or APIS. Airlines transmit these details to border agencies worldwide before flights depart. Governments use them to run security checks, prevent illegal travel, and manage immigration flows. Vietnam linked its system to data from 1,008 carriers. VietJet Air and Vietnam Airlines each contributed tens of millions of records. Twenty carriers each held more than a million records.
Each record painted a detailed picture. Full names, dates of birth, gender, nationality. Passport or travel document numbers along with expiration dates and issuing countries. Then the travel specifics: flight numbers and dates, departure and arrival airports, transit points, seat numbers, baggage references, and scheduled, estimated and actual times. Baggage tag numbers appeared in some entries. Nothing was redacted.
But the 220 million figure counts travel events, not unique people. Frequent flyers appear multiple times. Samples reviewed by BleepingComputer showed travelers from Korea, China, Canada, New Zealand and beyond. Crew from Russia’s Aeroflot and Belarus’s Belavia also showed up. Even tourists who visited Cam Ranh Bay.
The operator of the system has not been publicly confirmed. Kinryū Labs noted moderate confidence that a Vietnamese entity ran it, based on the hosting, data schema and dominance of local carriers. Vietnamese authorities did not respond to the researchers’ outreach. BleepingComputer could not independently identify the owner either.
This incident arrives as Vietnam strengthens its data protection rules. The country’s Personal Data Protection Law took effect in January 2026. It requires notification of violations within 72 hours of detection. Yet the precise timing of when this exposure became reachable through the secondary path could not be established.
Experts warn the consequences could linger. Passport numbers paired with dates of birth, travel histories and personal details give fraudsters powerful ammunition. Identity thieves could craft convincing phishing attacks. Criminals might attempt to clone documents or target individuals for scams.
And the technical failures that enabled it were basic. A chain of misconfigurations. Default credentials unchanged. No effective authentication on at least one access route. These lapses echo patterns seen in countless other breaches. Organizations collect sensitive information at massive scale. They often fail to secure it with equal care.
Kinryū Labs stressed that their enumeration was read-only. They recorded only counts, date ranges, field schemas and limited screenshots. The firm followed coordinated disclosure practices. The database was secured within days of their report. Yet the researchers could not rule out that others had found the same opening earlier.
Travelers who flew through Vietnam in the past nine years now confront uncertainty. They cannot easily check if their specific records were exposed. No public notification list exists. Airlines have not issued widespread alerts. The incident highlights a quiet truth about modern border systems. They depend on vast troves of personal data flowing between carriers and governments. When one repository fails, the privacy of millions collapses with it.
Similar exposures have occurred before. But few match the scale or the specificity here. Nine years of granular flight data. Passport details for a significant share of international travelers to one of Asia’s fastest-growing destinations. The breach touches tourists, business travelers, airline staff and citizens of dozens of countries.
The airline industry and governments must now reckon with the aftermath. Strengthening APIS implementations. Auditing access controls. Improving notification procedures when exposures occur. For the individuals whose data sat unprotected, the practical risks depend on what adversaries do next. Some may never know their information was compromised. Others could face targeted fraud years from now.
One fact stands out. A database built to protect borders ended up exposing the very people it was meant to screen. The chain of errors that caused it was avoidable. Its effects may not be.
WebProNews is an iEntry Publication