220 million traveler records exposed in Vietnam-linked APIS leak

A large Elasticsearch cluster named 'pax-info' containing approximately 220 million passenger and crew records was discovered exposed online. The database held detailed APIS data including identity and travel details for individuals who traveled to, from, or through Vietnam over a nine-year period. Access was gained by chaining two misconfigurations: an HTTP 401 response blocked direct access, but a cloud-based path allowed entry using default credentials. The cluster was hosted in Viettel-assigned IP space in Hanoi. The exposure was reported to Vietnamese authorities and airlines starting June 3, 2026, and access was remediated by June 8, 2026. There is no evidence of ransom notes or data being sold, but the extent of potential data misuse is unknown due to lack of server logs.

The exposure potentially compromises the personal and travel information of over 220 million passenger and crew records, including sensitive data such as passport numbers and flight details. This could lead to privacy violations, identity theft, and targeted attacks against affected individuals. The data covers multiple nationalities and international airlines, indicating a broad impact. However, there is no confirmed evidence of malicious exploitation or data exfiltration prior to remediation.

The issue was reported to relevant Vietnamese authorities, airlines, and national computer emergency response teams. Access to the database was remediated on June 8, 2026, by addressing the misconfigurations and removing default credentials. No further action is indicated by the reporting researchers. Organizations should verify that no unauthorized access occurred and review access controls to prevent similar exposures.