{"id":"vietnam-passenger-database-exposure-sep-2026","category":"breach","status":"closed","title":"Vietnam-linked passenger database exposed 220.8 million travel records, including passport details","tldr":"A Vietnam-linked database exposed 220.8 million passenger and crew travel records from 2017–2026. Access closed in June; malicious copying is unconfirmed. Travellers should verify unexpected requests using their trip or passport details.","summary":"Researchers found a Vietnam-linked passenger-information database containing 210,318,069 passenger records and 10,465,631 crew records. These count journeys rather than unique people. The records covered travel to, from or through Vietnam between January 2017 and April 2026 and included names, birth dates, nationalities, passport details and flight information, including seats and baggage references. Kinryū Labs attributed access to configuration failures rather than a software flaw. It discovered the database on 3 June; access closed on 8 June, before public reporting in September. The operator remains unidentified, and the exposure does not establish that the airlines’ own networks were breached. Researchers could not determine how long the data was accessible or whether malicious actors copied it. Their subsequent report left individual traveller notifications unanswered. No later incident update was found in the search through 3 November.","action":"If you travelled to, from or through Vietnam during this period, ask your airline whether your information was involved. Verify unexpected requests using trip or passport details through the airline’s official app or published phone number before sending money or identity documents. There is no device update for this database exposure.","product":"Vietnam-linked passenger and crew information database (APIS)","audience":"both","severity":"high","patch":"na","exploited":false,"cves":[],"tags":["vietnam","aviation","data-exposure","passport","travel"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"220 Million Traveller Records: A Vietnam-Linked Passenger Database Left Exposed","url":"https://kinryu.sh/reports/vietnam-apis-exposure/","by":"Kinryū Labs","date":"2026-09-09"},{"kind":"news","title":"220 million traveler records exposed in Vietnam-linked APIS leak","url":"https://www.bleepingcomputer.com/news/security/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/","by":"BleepingComputer","date":"2026-09-08"},{"kind":"news","title":"Massive data breach sees 220 million traveler records exposed — nine years of airline info leaked including passenger and passport details","url":"https://www.techradar.com/pro/security/massive-data-breach-sees-220-million-traveler-records-exposed-nine-years-of-airline-info-leaked-including-passenger-and-passport-details","by":"TechRadar","date":"2026-09-08"}],"started":"2026-09-08","closed":"2026-09-09","created":"2026-11-03T20:53:20.143Z","updated":"2026-11-03T20:53:20.143Z","cve_notes":[],"timeline":[{"at":"2026-09-09","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Kinryū Labs published its original report, identifying records naming 1,008 airlines and confirming that the specific exposure had closed. It still could not establish who operated the system, whether anyone else copied data or whether individual travellers would be notified.","url":"https://kinryu.sh/reports/vietnam-apis-exposure/","by":"Kinryū Labs","patch":null},{"at":"2026-09-08","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"BleepingComputer publicly reported the exposure of passport, identity and flight information spanning January 2017 to April 2026. The operator and exposure duration were unconfirmed, and malicious copying had not been established.","url":"https://www.bleepingcomputer.com/news/security/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/","by":"BleepingComputer","patch":null},{"at":"2026-06-08","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Access was closed, according to Kinryū Labs. BleepingComputer reviewed an email in which Singapore Airlines said it had contacted relevant parties and taken containment steps; this did not establish that the airline operated the database.","url":"https://www.bleepingcomputer.com/news/security/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/","by":"BleepingComputer","patch":null},{"at":"2026-06-03","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Kinryū Labs discovered the exposed passenger database and began notifying national incident-response teams, authorities and airlines. Its passenger and crew tables contained 220,783,700 travel records.","url":"https://kinryu.sh/reports/vietnam-apis-exposure/","by":"Kinryū Labs","patch":"na"}],"url":"https://hard.fyi/live/vietnam-passenger-database-exposure-sep-2026/","json":"https://hard.fyi/api/live?id=vietnam-passenger-database-exposure-sep-2026"}