Massive data breach sees 220 million traveler records exposed nine years of airline info leaked including passenger and passport details

Date:
Tue, 08 Sep 2026 20:40:00 +0000

Description:
A series of misconfigurations allowed researchers to access a treasure trove of sensitive data - the archive has since been locked down.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Kinry Labs found misconfigured APIS database in Vietnam exposing 220M passenger and crew records Data included PII, travel details, seat assignments, and baggage references from 20172026 Archive locked and there is no evidence yet of dark web sale
Millions of travellers have had their sensitive information exposed on the internet, thanks to a series of misconfigurations discovered in a cloud database, experts have warned.

In early June 2026, security researchers from Kinry Labs discovered an Elasticsearch cluster which, although inaccessible from the open internet, allowed access through an alternate route - a cloud-based path. Once inside that route, the researchers discovered that the cluster accepted default credentials, granting access to an archive with 29 indices, weighing roughly 107GB. The archive was apparently generated by an Advance Passenger Information System (APIS), a system airlines use to collect and send
passenger and crew information to country authorities before flight arrival
or departure. Usually, the system collects peoples names, birth dates, nationalities, passport and travel document numbers, and flight details,
which are then used for border control, immigration, and similar cases. In this case, however, it also contained peoples sex, document expiration dates, issuing countries, airlines, departure, destination and transit airports,
seat assignments, baggage reference, and more. Latest Videos From TechRadar Watch full video here:

It is not known who operated the APIS, or who owns and runs the database. All the researchers managed to find is that it was hosted in Viettel-assigned IP space in Hanoi, Vietnams capital. Who was affected? Of the 29 discovered indices, two were rather large: one contained 210,318, 069 passenger records, while another 10,465,631 crew records. In total, 220 million records, created between January 2017 and April 2026, from people who traveled to, from, or through Vietnam during that period. You may like Experts warn "colossal" breach exposes 24 billion records including personal info Manchester Airports hack: Experts weigh in on 8.7M data leak Over 9 million facial recognition images leaked in major breach at reverse image search and identity verification service

The records dont correspond to individuals, however. If a person travelled multiple times, they will show up in the archive multiple times. Canadians, Chinese, Korean, and New Zealandian nationals are among the ones whose information was exposed. The database is not limited to a specific airline, either - various airlines in Asia-Pacific, Europe, and Middle East regions were mentioned in the researchers report.

Since the researchers could not attribute the database to a specific entity, they reported it to the Vietnamese authorities, different airlines mentioned in the archives, and the countrys CERT (Computer Emergency Response Team), on June 3. The archive was locked down a week later, on June 8. According to BleepingComputer, it was the Singapore Airlines security team that took the lead on remediation efforts, telling the researchers they engaged the
relevant parties and have taken steps to contain the issue. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get
all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Without a proper audit of the logs, and a full-blown forensic investigation, it is impossible to tell if any threat actors reached the database before the researchers, or if they exfiltrated and used the data found inside in
identity theft, wire fraud, or other scams. Whats (somewhat) comforting is that there is no evidence of such activities on the dark web, and no hacking groups have made such claims. No one is selling the archive on the dark web, either. Number one causes of data spills Misconfigured databases remain one
of the key causes of data leaks. Most businesses generate some type of data
on their employees, partners, clients, or customers, and store it in the
cloud for easy access and actionable insights. However, some businesses dont understand the shared responsibility model of cloud security or are simply reckless and sloppy when it comes to securing their cloud-stored data.
Others, according to Cassius Edison, COO of Closed Door Security, have a problem with visibility of their IT real estate:

The range of technology now used and managed by firms globally has made misconfigurations an increasingly persistent problem, Edison explained. Many organizations fail to maintain full visibility of their IT real estate and fail to perform proper audits of their systems, which inevitably leads to oversights in security and monitoring. What to read next The biggest data leaker is probably not who you think it is How did the Manchester Airports Group cyberattack take place, and what data was exposed in the 8.7 million customer records? The experts weigh in Massive supply-chain attack sees terabytes of data leaked online

For Edison, tackling misconfigurations internally can be difficult,
especially at large companies where teams work independently across a range
of systems, and advises organizations to bring in independent pentesters and security auditors.

Some of the biggest data leaks in the world came not from hackers breaking into locked-down systems, but from businesses inadvertently exposing their customers.

In 2026 alone, weve seen more than 670 million identity records exposed by Infutor, a data-driven consumer identity management company, as well as more than three billion records exposed through a misconfigured MongoDB database managed by global identity verification services, IDMerit.

Via BleepingComputer The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/massive-data-breach-sees-220-million-tr aveler-records-exposed-nine-years-of-airline-info-leaked-including-passenger-a nd-passport-details


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)