APIS Leak: 220 Million Traveler Records Left Publicly Accessible

Researchers at Kinryū Labs discovered an exposed Elasticsearch cluster containing more than 220 million records on aircraft passengers and crew members. The system belongs to the APIS (Advance Passenger Information System) class — databases of this kind collect identity, passport and flight data from airlines around the world before passengers arrive or depart.

What ended up in the leak

The cluster, named pax-info, weighed about 107 GB and comprised 29 indices. Two main indices held 210,318,069 passenger records and 10,465,631 crew records — 220,783,700 entries in total. The data spanned the period from January 2017 to April 2026.

The records featured names, dates of birth, sex, nationality, passport or travel-document numbers, their expiry dates and countries of issue. Alongside this came flight information: flight numbers and dates, airlines, departure airports, destinations and layovers, cabin seats, baggage numbers, as well as scheduled, estimated and actual flight times.

Among the samples examined by journalists were citizens of Korea, China, Canada and New Zealand. Because the database covered a large number of international carriers across the Asia-Pacific region, Europe and the Middle East, almost anyone who flew to, from or through Vietnam over those nine years could have been affected. That said, the figures reflect flight records rather than unique individuals: frequent flyers appear in the database multiple times.

How access was obtained

There was no direct access from the internet — the endpoint returned a “401 Unauthorized” response. However, the researchers reached the cluster through a cloud path, and that path accepted default credentials. It was precisely this combination of two configuration errors that laid the database open.

The cluster was hosted in Viettel's IP space in Hanoi, but BleepingComputer was unable to confirm exactly which Vietnamese organization ran it. The FOFA platform first recorded the host back in October 2022 and identified it as a database in July 2023 — but when the passenger data became accessible through the second path could not be determined. As a result, the true duration of the leak remains unknown.

Kinryū Labs confirmed the authenticity of the data by cross-checking records against its own staff members' trips to Vietnam. The incident was reported to Vietnamese authorities, airlines and national CERTs starting on June 3; access was closed on June 8. Singapore Airlines' security team helped coordinate the response.

Whether the database was copied, sold or used by malicious actors before it was closed is unclear: the researchers found no trace of ransom notes, but without server logs no definitive answer can be given.

Source: Bleeping Computer