A database holding more than 220 million records tied to airline passengers and crew sat reachable on the open internet before researchers found it and reported it for closure. The records covered close to a decade of travel activity and included the kind of information that rarely needs to leave a government system once collected: passport numbers, dates of birth, nationalities and document expiration dates. The database has since been secured, but the scale of what was exposed, and the length of time it may have been sitting open, has drawn attention from security researchers well beyond Vietnam, where the system was hosted.
A 107 GB Database Called ‘pax-info’
The exposed system was an Elasticsearch cluster, a type of database commonly used to store and quickly search large volumes of records, running under the internal name “pax-info.” Researchers at Kinryu Labs came across it while surveying exposed databases as part of separate research into ransomware activity, and found a cluster containing 29 indices and roughly 107 gigabytes of data in total.
According to reporting on the discovery, the two largest indices inside the cluster held 210,318,069 individual passenger records and 10,465,631 crew records, for a combined total of 220,783,700 entries. That places it among the larger travel-data exposures documented in recent years, both in raw record count and in the range of personal fields involved.
Elasticsearch clusters are widely used across industries specifically because they can index and search enormous volumes of records quickly, which makes them a common choice for systems handling government or airline data at national scale. That same design, built for speed and easy querying rather than restricted access by default, is also why a misconfigured Elasticsearch deployment has been behind a number of the largest data exposures uncovered by researchers in recent years, well beyond this one incident.
What the Records Contained
The exposed fields went beyond basic contact information. Each record could include a person’s name, date of birth, sex, nationality, and passport or other travel-document number, along with the document’s expiration date and issuing country. Flight-specific details were mixed in as well, including flight numbers, seat assignments and baggage references tied to individual trips.
That combination is notable because it links a stable, long-lived identifier, a passport number, directly to specific travel movements. A passport number does not typically change for years, which means exposure of that kind of record carries a longer window of risk than something like a temporary login credential or a card number that can be canceled and reissued.
Nine Years of Travel Data in One Cluster
The records in the cluster were not limited to recent travel. They spanned January 2017 through April 2026, meaning anyone who flew to, from or through Vietnam at any point across roughly nine years could plausibly have had a record sitting inside the exposed database, regardless of nationality. Advance Passenger Information System data of this kind is typically collected by governments from airlines ahead of a flight’s arrival, as a standard border-security measure used well beyond Vietnam.
The length of that window is part of what makes the exposure significant. A breach limited to a single month or a single route affects a comparatively narrow group of travelers; a nine-year archive touches a far broader population, including people who may have flown once, years ago, and have no ongoing reason to think about that trip’s data today.
How the Cluster Was Found and Secured
Kinryu Labs traced the cluster to Viettel-assigned IP address space in Hanoi, and reporting on the case indicates researchers were able to reach the data through a cloud-based access path protected only by default credentials, compounded by additional configuration errors that widened what was reachable. That combination, default settings never changed after deployment, is a recurring theme in large-scale database exposures, and it typically means the data was technically public to anyone who found the right address, rather than requiring any advanced intrusion technique.
The exposure was reported and the cluster was secured in June 2026. Separate coverage of the incident notes that it remains unclear whether the data was accessed or copied by anyone with malicious intent before it was locked down, since an open database does not, on its own, keep a record of every party that may have viewed it.
Researchers who specialize in finding exposed databases generally scan broad ranges of cloud infrastructure looking for systems that respond without requiring authentication, rather than targeting any specific organization by name. That is consistent with how Kinryu Labs describes coming across the “pax-info” cluster, as one result among many turned up while surveying exposed infrastructure for an unrelated research project, rather than the product of an investigation focused on Vietnam’s travel-data systems specifically.
What Exposure Like This Usually Means for Travelers
Passport numbers on their own are not sufficient to open new accounts or drain a bank balance the way a leaked card number might, but they are frequently used as identity-verification data by airlines, hotels, visa services and government portals. Combined with a name, date of birth and nationality, all present in this exposure, that same set of details can support identity-fraud attempts, including fraudulent visa or travel-document applications filed using someone else’s identifying information.
Because the database is not known to include financial account numbers, the more immediate risk sits with document and identity fraud rather than direct monetary theft. Travelers with trips through Vietnam anywhere in the January 2017 to April 2026 window have no simple way to confirm individually whether their specific record was among those exposed, since the responsible authority has not published a lookup tool tied to the incident.
Security researchers generally advise that travelers whose documents fall within an exposed date range treat the underlying passport number the same way they would any other long-lived identifier caught in a large breach: watch for unexpected correspondence claiming to be from a visa office, airline or border authority, and verify any request for further personal information directly through an official channel rather than by following a link or number provided in the message itself.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
