A database of 220 million travelers sat open for four years, unguarded

On June 3, 2026, security researchers discovered an exposed Elasticsearch cluster containing 220,783,700 passenger and crew records, including passport numbers, birth dates, and flight itineraries spanning January 2017 through April 2026. The database, linked to a Vietnamese telecom operator’s IP space, was secured on June 8 after Singapore Airlines and researchers intervened.

The cluster had been flagged by internet scanning services as early as 2023, yet remained open for nearly four years. No operator has claimed ownership, and no mass traveler notifications have been issued.

For nearly four years, a searchable database of passport numbers, birth dates, and flight itineraries sat open on the internet, flagged by scanning services but never locked down. The cluster, named pax-info, held 220 million records covering anyone who flew to, from, or through Vietnam between January 2017 and April 2026. FOFA, an internet scanning service, had observed the host as early as 2022 and identified it as a database in 2023. Yet it took until June 2026 for researchers from Kinryū Labs to find it, and for Singapore Airlines to help press it shut. The exposure reveals a governance gap in the mandatory data pipelines that connect airlines to border agencies, where sensitive identity data is collected by law but protected by default credentials and misconfigured cloud paths.

The data that sat open for years

The cluster contained 29 indices and roughly 107 GB of data. Its two main indices held 210,318,069 passenger records and 10,465,631 crew records. Each entry included passport or travel-document numbers, birth dates, nationality, document expiration dates, issuing countries, and granular flight data—flight numbers, airlines, departure and arrival airports, transit points, seat assignments, baggage references, and scheduled, estimated, and actual times. A single traveler could appear dozens of times, creating a detailed movement dossier.

FOFA’s logs suggest the host was visible as early as 2022 and flagged as a database in 2023. That means the exposure window stretched across nearly four years, long enough for any motivated actor to copy the archive without detection. The access path was not a sophisticated hack. Researchers chained misconfigurations that opened a cloud-based route and then used default credentials to enter. Once inside, the full archive was readable.

The sequence below traces how passenger data moves from check-in to border systems, and where the exposure occurred.

Singapore Airlines’ security team, though not identified as the system operator, coordinated the response. An authenticated email reviewed by BleepingComputer showed the carrier telling Kinryū Labs on June 8 that it had engaged the relevant parties and taken steps to contain the issue. The cluster was locked down that same day, after researchers also alerted Vietnamese authorities, national computer emergency response teams, and several international airlines. Yet the operator remains unknown. The server sat in IP space assigned to Viettel in Hanoi, but no Vietnamese organization has publicly claimed ownership, and no airline has issued mass notifications.

The more lasting damage is to the assumption that border-screening data is handled with the same care as the security it is meant to enable. For a European business traveler who transited Hanoi three times in 2019, the exposure means a passport number, birth date, and seat preferences now exist in a database that was open to anyone who knew where to look. No dark-web sale has been confirmed, but the absence of a listing does not establish safety. Detailed datasets can circulate quietly among sophisticated actors.

The accountability vacuum

Vietnam’s Decree 13/2023/ND-CP creates breach-notification duties and pushes accountability onto controllers and processors, with reporting to the cybersecurity authority within 72 hours. The EU’s GDPR imposes similar timelines but emphasizes supervisory authorities and broader controller liability. In this case, the operator is unknown, so neither framework has been triggered publicly. The multinational nature of the data complicates enforcement: a European traveler passing through Hanoi might never learn their record was exposed, because notification requirements vary by country and by whether the operator qualifies as a data controller under local law.

The database is now locked, but any copies made during the exposure period cannot be recalled.

Beyond the headline

The Bigger Picture

This is less a one-off leak than a governance failure in data infrastructure that is supposed to be routine, not exceptional. The important shift is that travel-security systems now concentrate high-value identity data in places that are easy to search and, when badly configured, easy to expose.

The Reach

The server sat in IP space assigned to Viettel, but the operator remains unconfirmed. The non-obvious implication is that Western airlines and border agencies may inherit the trust damage and compliance burden even if they never ran the server themselves.

Unresolved risks after the lockdown

With the database now locked but no operator identified, travelers and companies face a set of unresolved risks.

• International traveler with past flights through Vietnam

  Your passport number, birth date, and detailed flight history between January 2017 and April 2026 were likely exposed. Monitor your financial accounts and loyalty programs for suspicious activity and consider changing passwords, as direct notification is unlikely. Check your airline’s fraud or security page within 24 hours if you transited Vietnam during that window.

• Airline security and compliance officer

  This incident highlights systemic vulnerabilities in mandatory APIS data handling and creates potential liability and reputational risk for your airline. Review your airline’s third-party data handling agreements and internal security protocols for APIS data to prevent similar exposures and ensure compliance with international data protection laws.

• Cybersecurity policy analyst focused on critical infrastructure

  This case exemplifies the risks of misconfigured critical border infrastructure and the challenges of accountability across international jurisdictions and private-public partnerships. Analyze this incident for policy recommendations on international data-sharing standards, mandatory security audits for critical travel systems, and cross-border incident response frameworks.

• Investor in Southeast Asian telecom or aviation sectors

  This exposure, linked to a major Vietnamese telecom’s IP space, signals potential regulatory scrutiny, increased compliance costs, and reputational damage that could impact your investments. Assess the cybersecurity governance and data protection practices of your portfolio companies in these sectors, particularly those handling sensitive international data, to mitigate future risks.

FAQ

Explainer

APIS

Advance Passenger Information System, a mandatory data-sharing mechanism that requires airlines to transmit passenger and crew details to destination governments before departure for security screening and immigration control. The system creates a high-value repository of identity and travel data that is legally required but often protected by varying security standards. In this incident, an APIS-related database was exposed due to misconfigurations, not a failure of the transmission protocol itself.

Elasticsearch

A searchable, distributed database designed to store and quickly retrieve large volumes of structured and unstructured data. It is widely used for log analytics, full-text search, and operational intelligence. When misconfigured—as in this case, with default credentials and an open cloud path—an Elasticsearch cluster can become an open archive accessible to anyone who discovers its endpoint.

FOFA

An internet scanning service that maps and indexes devices and services connected to the public internet, similar to Shodan. It can identify exposed databases, servers, and industrial control systems. FOFA had recorded the pax-info host as early as 2022 and flagged it as a database in 2023, indicating the exposure was known to scanning platforms long before researchers intervened.

Decree 13

Vietnam’s Decree 13/2023/ND-CP on personal data protection, effective July 1, 2023, establishes breach notification duties, requires reporting to the Ministry of Public Security’s cybersecurity unit within 72 hours of detection, and pushes accountability onto data controllers and processors. It is Vietnam’s primary data protection framework, more centralized than the EU’s GDPR but with similar notification timelines.