A database containing more than 220 million passenger and crew records was accessible online through a chain of two security misconfigurations, according to researchers at Kinryū Labs who discovered it on June 3, 2026. The cluster, named “pax-info” and hosted in Viettel-assigned IP space in Hanoi, held 210 million passenger records and 10 million crew records covering travel to, from, and through Vietnam between January 2017 and April 2026. The exposed fields included full names, dates of birth, nationalities, passport and travel-document numbers, document expiration dates, and issuing countries — the same data that airlines collect through Advance Passenger Information Systems, the industry-standard mechanism governments use to screen passengers before departure. Travel details in the database included flight numbers, airlines, departure and arrival airports, transit airports, seat assignments, and baggage references. Kinryū Labs confirmed the data was genuine by matching records against its own researchers’ travel histories.
The database was technically protected: from the open internet it returned HTTP 401 Unauthorized. But a cloud-side path let researchers reach the cluster directly, and from there it accepted default credentials. Internet intelligence platform FOFA first indexed the host in October 2022 and identified it as a database in July 2023 — meaning the misconfigurations may have existed for years before the data was first retrievable through the exposed path. Kinryū Labs reported the issue to Vietnamese authorities, affected airlines, and national CERTs on June 3; the cluster was secured on June 8. Singapore Airlines confirmed it had engaged the relevant parties and taken steps to contain the issue. Whether the database was downloaded or exploited before remediation remains unknown — the researchers found no ransom notes or unfamiliar indices, and could not find the data being offered for sale online, but server logs were inaccessible.