Wide-open airline database leaked 220 million passenger records, researchers say
A Vietnam-linked passenger screening system sat on the internet with default logins, exposing nine years of travel data.
Key points
- Researchers found an Advance Passenger Information System (APIS) database holding 220 million passenger and crew records exposed to the open internet.
- Records spanned 2017 through 2026, covering full names, passport numbers, dates of birth and flight itineraries.
- The system was reachable through a cloud address using default, factory-set login credentials.
- The database is linked to Vietnamese aviation infrastructure, though the exact operator hasn't been publicly named.
- Anyone who flew on affected routes should assume their passport details may be in criminal hands and watch for targeted scams.
A passenger screening database containing 220 million traveller records was left wide open on the internet, according to researchers who found it while scanning cloud services. The system is an Advance Passenger Information System, or APIS: the software airlines use to send passenger details to border authorities before a flight lands. This one is linked to Vietnam. The exposure was first reported by BleepingComputer.
The database was reachable through a cloud-hosted address and protected only by the default username and password shipped with the software. Nobody had changed the factory login. That's the digital equivalent of leaving the key in the door.
What was actually in the database?
Personal and travel data on roughly 220 million people, going back nearly a decade. Each record could include a passenger or crew member's full name, passport number, date of birth, nationality and the specific flights they took. The dates run from 2017 to 2026, meaning forward bookings were caught up in the leak too.
Passport numbers are the sensitive part. Unlike a password, you can't rotate a passport in an afternoon. Criminals use leaked passport data to open fraudulent accounts, build convincing impersonation kits and apply for credit. Our earlier report on nuclear-blueprint theft from the Philippines on 2 September 2026 found passport files belonging to government scientists in the stolen haul, a reminder of how passport data gets weaponised long after the initial breach.
| Detail | Figure |
|---|---|
| Records exposed | ~220 million |
| Date range covered | 2017 to 2026 |
| System type | Advance Passenger Information System (APIS) |
| Access method | Cloud endpoint, default credentials |
| Country link | Vietnam |
How did the data get out?
Someone stood the system up in the cloud and never changed the default login. Researchers found it during routine internet scanning, connected with the known factory credentials, and read the full dataset. No exploit chain. No zero-day (a previously unknown software flaw) was needed. Just a door left unlocked.
This pattern isn't rare. Cloud-hosted databases from vendors across the Elasticsearch and MongoDB ecosystems, along with commercial airline back-office products, regularly turn up unauthenticated on the public internet. Vendors ship documentation that recommends hardening. Operators skip it during deployment.
Which airline, ground handler or government contractor ran this specific instance hasn't been made public. Researchers say they contacted the party they believed responsible and the database was eventually taken offline.
Should ordinary travellers be worried?
If you flew on Vietnamese routes or Vietnam-bound flights in the last several years, treat your passport number as potentially known to strangers. Fraud isn't imminent, but your baseline risk for a handful of specific scams is higher.
Watch for emails, texts or calls that claim to be from an airline, an embassy or a border agency and quote your real travel details to sound legitimate. That trick is called phishing, where criminals send fake messages designed to extract more information or a payment. Real airlines won't ask you to confirm your passport number by replying to a text.
If your passport turns up in suspicious account-opening attempts, most countries let you flag it with the issuing authority.
The bigger picture
APIS feeds are a required part of international aviation. Every carrier sends them, which means the security of border data doesn't rest with border agencies alone. It rests with every airline, handler and IT contractor in the chain. A default password at one small vendor can expose data belonging to passengers of dozens of carriers who never chose to trust that vendor.
Regulators in the EU and UK have fined companies heavily for exactly this class of failure. The plain judgement here: misconfigured cloud storage keeps topping breach reports not because the attacks are clever, but because the fixes aren't being made. Scrutiny should follow this one, and the operator's identity will matter when it does.
