Exposed APIS Database Contained 220 Million Vietnam-Linked Traveler Records
Summary
Researchers found 220 million passenger and crew records in an exposed APIS database linked to travel through Vietnam. Chained misconfigurations enabled access; the issue was remediated, but whether data was copied or sold is unknown.
Key points
- The Elasticsearch cluster contained 220,783,700 passenger and crew records spanning January 2017 to April 2026.
- Records included names, birth dates, passport or travel-document details, and flight information such as routes, dates, airlines, and seat assignments.
- Researchers linked the data to travel to, from, or through Vietnam; the system was hosted in Viettel-assigned IP space, but its operator was not confirmed.
- Kinryū Labs said it reached the cluster through chained misconfigurations: a cloud-based access path and default credentials.
- Researchers verified sample records against their own travel to Vietnam; the counts represent travel records, not unique individuals.
- The issue was reported beginning June 3 and access was reportedly remediated on June 8, with Singapore Airlines helping coordinate the response.
- Researchers found no ransom notes or unfamiliar indices, but without server logs they could not determine whether the data had been copied, sold, or otherwise accessed.
Article Details
- Victim Organization
- Unknown
- Incident Type
- Exposure of an online APIS database caused by chained security misconfigurations and default credentials
- Data Types Exposed
- Names
- Dates of birth
- Sex
- Nationalities
- Passport or travel-document numbers
- Document expiration dates
- Issuing countries
- Flight numbers and dates
- Airlines
- Departure, destination, and transit airports
- Seat assignments
- Baggage references
- Scheduled, estimated, and actual flight times
- Affected Records
- 220,783,700 passenger and crew records (210,318,069 passenger records and 10,465,631 crew records); these represent travel records, not unique individuals.
- Affected Data Size
- Approximately 107 GB
- Operational Impact
- The database was accessible online through chained misconfigurations. Researchers reported the issue beginning June 3, and access was remediated on June 8. The duration of exposure is unknown.
- Ransom Or Extortion
- Unknown whether the data was downloaded, sold, ransomed, or otherwise exploited. Researchers found no ransom notes or unfamiliar indices and could not identify the dataset for sale online; without server logs, they could not rule out copying.
- Claim Status
- confirmed