Exposed APIS Database Contained Data on More Than 220 Million Travel Records
Researchers flagged a publicly accessible system containing travel and identification data linked to Vietnam. It has not been confirmed whether anyone copied or misused the data.
Vietnam APIS database, according to findings reported by BleepingComputer, contained 220 783 700 records of passengers and crew members. Researchers discovered it on June 3, 2026, and said access was removed after notification on June 8. The case was publicly disclosed on September 8.
The database contained 210 318 069 passenger records and 10 465 631 crew-member records. However, this is not the number of unique individuals: the system included data from January 2017 through April 2026, so one person may have been recorded repeatedly.
Vietnam APIS database contained passport and flight data
The records contained sensitive identification and travel information. This included names, dates of birth, nationality, travel document numbers and their validity. The database also included flight and baggage data.
APIS, or the Advance Passenger Information System, processes data used in international air transportation. In this case, the scope of the records suggests an international reach, but the mere presence of the data does not show that the networks of individual airlines were compromised.
Singapore Airlines, according to BleepingComputer, confirmed that it had engaged relevant parties and taken steps to limit the incident. However, the published information does not provide a complete list of affected carriers or individuals.
Two misconfigurations and default login credentials
Researchers said the cluster was accessible through a combination of two misconfigurations, one of which was reportedly the use of default login credentials. The system was located in an IP space assigned to Viettel in Hanoi.
However, this circumstance alone does not confirm who operated the database or who was responsible for securing it. It has not been publicly confirmed which specific Vietnamese organization managed the system. As of the date of publication, no public statement from a Vietnamese authority or the system operator was available.
The case highlights the risks of improperly secured cloud environments and retained default login credentials, especially in systems processing passport and travel information.
Data download or misuse not confirmed
The most important unanswered question is whether anyone copied, sold or misused the data while the system was accessible. Researchers did not have access to server logs, so they cannot confirm or rule this out.
If the records were copied, the combination of travel-document data and trip details could be used for more convincing targeted fraud, phishing or tracking travel patterns. For now, however, this is not a confirmed data breach into the hands of attackers.
According to available information, Kinryū Labs promised a technical report but has not yet published it. Any statements from Vietnamese authorities, Viettel, the identified operator, airlines and regulatory bodies will also be important.
Sources
- BleepingComputer – Provides the original report on the database’s size, data types, alleged access method, notification timeline and statement from Singapore Airlines.
- Kinryū Labs – Identifies the research group cited in the report and its stated practice of notifying affected organizations; a technical report on this case has not yet been publicly available.
Verified and updated: 09/08/2026 15:21
