Vietnam Database Leak Exposes 220M Traveler Records

A significant data leak has been uncovered, affecting an estimated 220 million passenger and crew records due to critical misconfigurations in a cloud database. Security researchers from Kinryū Labs identified an Elasticsearch cluster, accessible via an alternate cloud path and using default credentials, which housed approximately 107GB of sensitive information.

This exposed data, originating from an Advance Passenger Information System (APIS), contained extensive personal details, including names, birth dates, passport numbers, travel itineraries, seat assignments, and baggage references. The affected records, spanning from January 2017 to April 2026, involved travelers to, from, or through Vietnam, with nationalities including Canadian, Chinese, Korean, and New Zealander.

Reported to Vietnamese authorities and various airlines on June 3, 2026, the database was secured by June 8, with Singapore Airlines leading remediation efforts. While the immediate exposure is concerning, there is currently no evidence of the data being sold on the dark web or used for fraudulent activities. However, the incident highlights the persistent risks associated with misconfigured cloud storage and the ongoing challenges in maintaining comprehensive IT security visibility.