Vietnam APIS Database

Kinryu Labs found an Elasticsearch cluster on June 3 while surveying exposed databases. It was labelled pax-info and reachable over the open internet. It accepted default credentials, which means anyone who located the endpoint and tried the out of the box login was inside.

Two indices held 210,318,069 passenger records and 10,465,631 crew records, a combined 220,783,700 entries covering January 2017 to April 2026. The system carries Advance Passenger Information, the data airlines transmit to border authorities before a flight departs. Researchers linked it to a Vietnamese organization. No ministry, airline or processor has claimed it since.

Names, dates of birth, sex, nationalities, passport or travel document numbers, document expiry dates and issuing countries, tied to flight records. This is the full identity page of a travel document, held against a movement history.

It covers anyone who flew to, from or through Vietnam across nine years, which makes the affected population international rather than national. A passport number plus a date of birth plus a nationality is enough to impersonate a traveler in systems that verify against exactly those fields.

Travelers of many nationalities who have no relationship with the operator and no way to identify themselves as affected. There is no customer list to notify because the people in the database were never customers of whoever held it.

Crew records are the sharper risk in a smaller set. Ten million crew entries map identities to routes and schedules over years, which is targeting data rather than marketing data. For passengers, the exposure is a durable identity document number that most people will not replace until it expires.

Advance Passenger Information exists because governments require it. Collecting it is compliance, and transmitting it to border authorities before departure is the entire point of the system. Somebody built infrastructure to do a mandated job.

Nothing about the requirement asks for nine years of retention on an internet facing cluster with vendor default credentials. The obligation was to transmit. The failure was in what happened to the copy afterward, in a system whose owner has not yet been publicly established.

The clearest signal here is not a slow notification. It is that no organization has claimed the database at all. More than two months after discovery, the operator remains unidentified in public reporting.

That is what an unowned data asset looks like from the outside. Somebody provisioned it, loaded it and left it, and the accountability chain between the airlines that supplied the records, the authority that required them and the processor that stored them is unresolved. A record nobody admits to holding is a record nobody was inventorying.

Default credentials on an internet facing store holding 220 million passport numbers is not an advanced failure. It is the absence of anyone checking what that system contained or who was responsible for it.

There is no attacker to attribute. Researchers found it during routine survey work, which means the disclosure path was responsible rather than criminal. That is the good news and it is thin.

An open cluster carrying default credentials for an unknown period is available to everyone who scans, not only to the team that reported it. Absence of a leak site post is not evidence that nobody else arrived first.

Deleting the transmitted records once the border authority had them. APIS is a message, not an archive. A nine year retained copy serves no operational purpose that justifies holding 220 million passport numbers.

Failing that, an owner. The single most useful control here would have been a maintained inventory that tied this data store to a named accountable party, with a record of what it contained. Every other control depends on somebody knowing the system exists.