220 million traveler records exposed in Vietnam-linked APIS leak

[XploitLK-Bot]

An exposed Advance Passenger Information System (APIS) database linked to Vietnamese aviation infrastructure left roughly 220 million passenger and crew records publicly accessible. The cache included names, passport numbers, dates of birth, nationalities, and flight details, with entries spanning 2017 to 2026.

Researchers found the cloud-hosted system reachable via a public path that still accepted default credentials, allowing unrestricted read access without any authentication bypass or sophisticated exploit. The dataset reportedly covered both passengers and crew members, raising concerns regarding long-term identity theft and targeted phishing campaigns.

• Exposed data: full names, passport numbers, dates of birth, nationalities, and flight itineraries.
• Timeframe: records from 2017 through 2026.
• Root cause: default credentials left active on a cloud-based APIS instance.
• Access method: direct connection to the exposed system using vendor-default login details.

The findings underscore persistent risks tied to misconfigured cloud deployments and unchanged factory settings, especially in border-control and travel infrastructure. It remains unclear whether the operator has restricted access or rotated credentials since the disclosure. Travelers whose data may be involved should monitor for unsolicited communications referencing flight history or passport details.

Source: BleepingComputer

For those in travel or aviation security, how is your organization auditing cloud-facing systems for default credential usage, and would a discovery like this prompt an immediate review of your APIS or PNR handling procedures?