220 Million Traveler Records Exposed in Vietnam-Linked APIS Leak

How the Exposure Went Undetected

An exposed Advance Passenger Information System database containing over 220 million passenger and crew records was accessible online due to security misconfigurations. The leak, discovered in September 2026, included passport numbers, flight details, and personal travel information. The system appears linked to Vietnam-based infrastructure, raising concerns about data protection in aviation security systems worldwide.

The database was found through a chain of misconfigurations that left sensitive information publicly accessible without authentication. Records contained biometric-linked data, visa details, and itineraries for both commercial and private flights. Experts noted the scale suggests systemic vulnerabilities in how airlines and governments handle advance passenger data, particularly in regions with growing digital aviation infrastructure.

Could This Leak Have Been Prevented With Basic Protocols?

Security researchers traced the leak to a misconfigured cloud storage instance that indexed the APIS feed without proper access controls. The data was available via standard web protocols, meaning anyone with the link could download full records. Despite the volume, no intrusion detection systems flagged the abnormal access patterns, highlighting gaps in monitoring for large-scale data leaks in aviation systems.

Industry analysts say the exposure resulted from failures to apply fundamental security practices like network segmentation and regular penetration testing. Aviation authorities typically require APIS data encryption and strict access logs, but these controls were either missing or improperly implemented. The incident underscores the need for mandatory third-party audits of government-contracted data systems handling sensitive traveler information.

What is an Advance Passenger Information System? APIS is a system used by countries to collect passenger and crew data before arrival, allowing border agencies to screen travelers for security and immigration risks using passport and flight details.

Frequently Asked Questions

Why was the data stored without proper protection? The leak stemmed from misconfigured cloud storage settings that removed authentication requirements, likely due to human error during setup or maintenance, not a sophisticated cyberattack.

Are affected travelers at risk of identity theft? Yes, exposed passport numbers and personal details increase the risk of fraud, though experts note misuse depends on whether the data was downloaded and how quickly it was secured after discovery.