220 Million Traveller Records: A Vietnam-Linked Passenger Database Left Exposed

TLP:CLEAR. Kinryū Labs discovered this exposure on 3 June 2026 during research into exposed databases and reported it the same day; access was closed within days. The enumeration was read-only: only aggregate counts, the date range, the field schema and a small number of screenshots were recorded. Every screenshot in this report has the fields that identify a person, name, passport number and date of birth, blacked out. No individual passenger or crew record was retained, published or shared beyond the authorities notified during disclosure. The source host address, port and credential are withheld. The operator of the system was not confirmed.

Summary

• 210Mpassenger records
• 10.4Mcrew records
• 9 yearsof flights, 2017 to 2026
• 1,008airlines in the data

On 3 June 2026, during a broad survey of databases left open on the internet, we found an Elasticsearch cluster named pax-info. Elasticsearch is a database engine for searching large volumes of records. This one was not wide open to the whole internet: a request sent to it directly was refused. But it could be reached through a cloud vantage point, and once reached, it accepted the Elasticsearch default login, a factory-set username and password that the operator had never changed. That is no real protection. Behind it sat 220,783,700 travel records running from 7 January 2017 to 30 April 2026.

The survey that turned this up mostly finds dull things: test data a developer left behind, a shop’s product catalogue, a wiped database with a ransom note where the records used to be. This cluster was not dull. It held a nine-year archive of border-control data, and the newest records were about five weeks old when we found them, so the system was still being written to. It was live.

The data is Advance Passenger Information. Before an international flight, an airline sends the destination country a manifest of who is on the plane, so the border service can pre-screen everyone on board. The fields are standardised by ICAO, the United Nations agency that sets civil-aviation rules. In plain terms, this is some of the most sensitive data a state holds about ordinary travellers: for each person, a real name and date of birth tied to a passport number, and a record of exactly where they went and when.

What each record contains

Each record ties a full name, date of birth, sex and nationality to a passport or travel-document number, its expiry date and its issuing country, and then attaches the trip: flight number, date, origin, transit and destination airports, seat and baggage reference. Name, date of birth and passport number together let someone impersonate a traveller or forge a travel document, and the itinerary shows where a named traveller was on a given day.

A single record’s shape, as we noted it with every identity value withheld:

flightDate: 2026-04-30  flightNumber: VN0402  fromAirportCode: HAN (Hanoi)  toAirportCode: ICN (Seoul-Incheon)  guestNameOriginal: [REDACTED]  birthday: [REDACTED]  nationalityCode: [REDACTED]  documentNumberOriginal: [REDACTED]

Who was in the database

The obvious reading of a Vietnamese passenger system is that it holds Vietnamese travellers. It holds far more than that. The nationalities on the records run across the world, Dutch, Chinese, Belarusian, Korean, Japanese, French, German, Canadian, Malaysian, and the airlines number 1,008. Anyone who flew a route that touched a Vietnamese airport, on almost any carrier, over nine years, is a candidate to be in here.

Two of those carriers stand out. Among the crew records are rosters for Aeroflot, the Russian flag carrier, and Belavia, the Belarusian one, both of which operate under Western sanctions. Their crews’ names, dates of birth and passport numbers sat in the same open store as everyone else’s. The passenger side carries the matching civilian traffic: Belarusian nationals booked into Cam Ranh, the beach city beside Nha Trang that has long been a destination for Russian and post-Soviet tourism. Whatever one makes of that, these were among the most trivially exposed travel records of all.

The system also reached past people whose journey began or ended in Vietnam. Each record carries separate first-, transit- and destination-airport fields, and many name only foreign airports, Hong Kong, Singapore Changi, Shanghai, Macau, Kuala Lumpur. Connecting and transiting passengers were captured alongside everyone else, their full identity attached to a journey that need not have begun or ended in Vietnam at all.

Down to the baggage tag

The detail does not stop at who and where. Each record also carries the operational trace of the trip, including the baggage-tag reference checked in against that passenger. It is the number on the sticker wrapped around your suitcase handle, the one that says where the bag is going and ties it to you. For a data set this size, that is an unusual depth of granularity: not just that a person flew, but which bag was theirs.

How the cluster was reachable

The cluster was not sitting wide open to the whole internet. A request sent to it directly was refused. What made it reachable was a cloud vantage point: from there the database answered, and it accepted the Elasticsearch default login, the username and password the software ships with, which the operator had never changed. A default credential is not a defence. It is documented publicly and is the first thing any scanner tries. No software vulnerability was exploited, and none was needed. Once inside, the cluster’s own web console offered a Download as JSON button: the data did not even require a script to take.

The exposure was not a matter of days. The passenger index was created on 15 September 2022. The public internet-scan service FOFA first recorded the host in October 2022, and by mid-2023 was classifying it as a database. So the store had been reachable, on its default login, for well over three years before we found it. Whether the passenger data was retrievable across that entire period, and who else reached it, we cannot say.

How we counted it without reading it

We counted the cluster without reading anyone’s record. Elasticsearch answers questions of the form “how many records match this” and “break these down by airline” through its count and aggregation interfaces, which return totals and per-category tallies and never hand back an individual row. We kept document counts, the date range of the data, the list of field names in the schema, and a small number of screenshots with every identifying field blacked out, taken only to confirm the fields were populated. No individual passenger or crew record was retrieved, stored or passed to anyone beyond the authorities we notified.

An index in Elasticsearch is roughly one table. The two that held people were sized as follows.

• 109,232,811records marked male
• 101,085,255records marked female
• 1,008airlines named in the data

Index	Records	Size
Passengers (guest-v3-index)	210,318,069	95.3 GB
Crew (crew-index)	10,465,631	4.3 GB

Twenty carriers over a million records

The exposed set reaches far more travellers than Vietnam’s own. It named 1,008 carriers, of which 20 each held more than a million records.

Carrier	Records
VietJet Air	45,820,123
Vietnam Airlines	43,184,871
Korean carriers (Korean Air, Asiana, Jeju Air, Jin Air, Tway)	~24.7 million
Singapore carriers (Singapore Airlines, Scoot)	~7.7 million

Qatar Airways, Emirates, All Nippon Airways, Cathay Pacific and China Southern each hold millions of records as well. That the top of the list is two Vietnamese carriers is no surprise. That it then runs through the flag carriers of Korea, the Gulf, Japan and China is the point: this was never only Vietnam’s data to lose. We cannot say from the records what arrangement funnelled foreign carriers’ passenger manifests into a single Vietnam-hosted store and kept them there for nine years.

Where the cluster was hosted

We assessed attribution only from what was already in hand: the hosting network, the index architecture, the carrier mix, the data recency and the access-control state. The cluster sat in network space assigned to Viettel, Vietnam’s state telecom, under AS38731. An ASN is the identifier for the network operator behind an internet address, and this one is registered to a Hanoi technology park. The schema is an ICAO Advance Passenger Information feed, and the carrier mix is led by the two Vietnamese carriers, with 45,820,123 records on VietJet Air and 43,184,871 on Vietnam Airlines. That hosting and carrier mix match a system that ingests every international movement through Vietnam.

Our own assessment at the time:

On every axis checkable from data already in hand, the evidence is consistent with this being a genuine, live Vietnamese passenger-information system that was left exposed, not a copy hosted by a third party elsewhere.

Parties reselling stolen data do not usually host it on a traceable domestic network inside the victim country, and their copies are stale by the time they surface. The domestic hosting, the purpose-built schema and the five-week recency together read as live data rather than a resold dump.

Disclosure

• 3 June 2026We found the exposed cluster during research into open databases and began notifying affected and responsible parties the same day: national CERTs, data-protection authorities, aviation bodies, and the airlines whose passengers were in the set.
• Within daysThe host went offline and was no longer reachable. The specific exposure was closed.

We reported it the day we found it, and did not publish until access was closed. The enumeration was read-only, and no individual’s record has been retained or shared beyond the authorities notified.

What we still cannot say

The specific hole is closed, but the larger questions are not ours to answer:

• How long it was open. The passenger index dates to September 2022, and public scanners recorded the host from October 2022. Whether the data was retrievable across that entire period, and whether anyone else accessed or copied it, we cannot determine.
• Who was accountable. The operator remains unidentified, and the Vietnamese authorities we notified did not respond.
• Whether travellers will be told. Whether the airlines and national data-protection authorities will notify the individual travellers whose records were exposed is unanswered.
• How the data pooled. Why the manifests of so many foreign carriers were consolidated into one Vietnam-hosted store, and kept there for nine years, is not something the records explain.

If you run a database on the internet

The mistake here is common and cheap to avoid. For teams running Elasticsearch or any similar store:

• Change the default login, and keep the data port off the public internet. The credential the software ships with is public knowledge; leaving it in place is the same as having no password. Turn on real authentication and put the database behind a network boundary.
• Assume anything reachable will be found. Internet-wide scanning is continuous and automated. This host was catalogued by a public scanner years before we found it.
• Know where your most sensitive data lives, and who can reach it. The damage here comes from one store holding identity and movement data for hundreds of millions of people, reachable through a vantage on an unchanged default login. Inventory those stores first.