A misconfigured Vietnam-linked Advance Passenger Information System database exposed 220 million passenger and crew travel records from 2017 to 2026, including names, passport numbers, nationalities, flight details, seat assignments, and baggage references. Security researchers at Kinryu Labs found the unsecured Elasticsearch cluster in Viettel-assigned IP space while surveying databases for ransomware research. Default credentials and other security errors left roughly 107 GB of sensitive information accessible online. The database was secured after disclosure, but investigators cannot determine whether attackers copied or misused the data. The incident raises fresh concerns about airline data protection and cross-border oversight of critical travel information systems.
This update represents a notable development in the Board sector. Organizations and founders tracking this space should evaluate potential strategic and technical implications on their operations.