220 Million Travel Records Exposed: Your Passport May Be in This Leak

Your Passport Number Has No Reset Button

Nine years of airline records sat open on the internet, unprotected, for at least five days. Anyone who knew where to look could read them. The data, wait, I can't use em dashes. Let me just write this properly.

Your Passport Number Has No Reset Button

Nine years of airline records sat open on the internet, unprotected, for at least five days. Anyone who knew where to look could read them. If you flew through Vietnam between January 2017 and April 2026, your passport number may now be in someone else's hands forever.

That last word is the one that matters.

What Is APIS, and Why Does It Contain So Much About You?

Advance Passenger Information Systems are the quiet infrastructure behind every international flight. Before your plane pushes back, the airline transmits your identity documents and itinerary to border authorities. It is how governments screen passengers before they land. APIS data is precise by design: full legal name, date of birth, sex, nationality, passport number, document expiry, issuing country, flight number, seat assignment, baggage tag, departure and arrival airports, and actual flight times.

Viettel, Vietnam's state-owned telecommunications company, operated one such system. That system stored 220 million records. And then it left them where anyone could find them.

How Did This Happen?

Security researchers at Kinryū Labs found an unprotected Elasticsearch database on June 3, 2026, sitting in IP address space belonging to Viettel. They did not need to hack anything. They chained together two simple misconfigurations: a cloud-hosted path that bypassed the login screen entirely, and then default credentials on the database cluster itself. Default credentials means the operator never changed the factory password. Both failures are the kind of thing a checklist catches.

Access to the database closed on June 8. The researchers disclosed their findings to BleepingComputer and TechRadar, which published the story on September 12, 2026.

Nobody has confirmed whether anyone copied the data before the window closed. That five-day gap is the unresolvable uncertainty every affected traveler now lives with.

How Big Is 220 Million Records?

The database held 210 million passenger records and 10 million crew records, covering January 2017 through April 2026. That is nine years of every flight touching Vietnam's air travel infrastructure. Millions of those passengers were Western tourists, business travelers, digital nomads, and backpackers passing through Southeast Asia. Vietnam is one of the region's most visited countries. If you flew into Hanoi or Ho Chi Minh City, took a connection through Da Nang, or routed through the country even once during that period, your record may be in this dataset.

The crew records matter too. Flight attendants and pilots who worked those routes for nearly a decade are in there as well.

Why Passport Numbers Are Different From Passwords

When your email password leaks, you change it in two minutes. When your credit card number leaks, the bank cancels the card and mails you a new one. Passport numbers do not work that way.

A passport number is permanent for the life of that document, typically ten years. Most countries will not issue a replacement passport unless you report it lost or stolen and pay a replacement fee, and even then the old number exists in records across dozens of government databases worldwide. You cannot revoke it. You cannot rotate it. A thief who holds your passport number, paired with your full name, date of birth, nationality, and travel history, has a profile that does not expire when you renew.

That combination is especially useful for identity fraud, phishing attacks targeted at your known travel patterns, and synthetic identity schemes that blend real document data with fabricated credentials.

What Should You Do Right Now?

1. Check your travel history. If you flew to, from, or through Vietnam at any point between January 2017 and April 2026, treat your passport number as potentially exposed. That applies to any airline operating routes through Vietnamese airports, not just Vietnamese carriers.

2. Report your passport if it is still active. Contact your country's passport authority and explain you believe your passport number was exposed in a data breach. Ask whether a precautionary replacement is possible. Some countries accommodate this. It is worth a phone call.

3. Place a fraud alert or credit freeze. In the United States, you can freeze your credit at all three bureaus for free at Equifax, Experian, and TransUnion. A freeze blocks most new credit applications in your name. A fraud alert requires creditors to verify your identity before opening new accounts. Both are free. Other countries have equivalent mechanisms through their financial regulators.

4. Watch for targeted phishing. Your leaked travel records include flight numbers and seat assignments. A convincing phishing email might reference a specific flight you actually took nine years ago. Be skeptical of any message that cites your travel history as proof of legitimacy.

5. Enable strong authentication everywhere. Passkeys and hardware security keys are the strongest options. At minimum, use an authenticator app rather than SMS for any account tied to your identity or finances.

6. Consider a data removal service. Companies like DeleteMe or Incogni submit opt-out requests to data brokers on your behalf. They do not remove data from government records or criminal marketplaces, but they reduce your surface area on commercial people-search sites that scammers mine.

The Closing Truth

Two unchecked configuration settings exposed 220 million people to permanent identity risk. No sophisticated attack. No zero-day exploit. Just a cloud path that nobody locked and a password that nobody changed.

That is the real story here. The vulnerability was not technical complexity. It was neglect. And because passport numbers cannot be reset, that neglect has a cost that does not expire when the database closes.

Do this now:

• If you flew through Vietnam between 2017 and 2026, assume your passport data is out there
• Call your passport authority and ask about a precautionary replacement
• Freeze your credit for free at all three major bureaus
• Turn on the strongest 2FA available on every account tied to your identity

Sources

• bleepingcomputer.com
• techradar.com