AINEWS
A misconfigured cloud archive in Hanoi held nine years of border control passenger filings, including passport numbers, until researchers found it in June 2026. The operator remains unknown.
A cloud archive of roughly 220 million airline records sat behind a default username and password for as long as anyone can tell, reachable through a misconfigured route into a cloud-hosted Elasticsearch database in Hanoi. The archive held nine years of border-control filings, the kind of passenger data governments require airlines to hand over at every international flight.
Security researchers at Kinryū Labs found the cluster in early June 2026. The system, an Advance Passenger Information System, or APIS, was not directly open to the internet, but a cloud-based path into it accepted the system's factory-set credentials. Once inside, the researchers counted 29 separate indices totaling roughly 107 gigabytes. The records spanned January 2017 to April 2026, with 210,318,069 passenger rows and 10,465,631 crew rows, about 220 million in all.
The 220 million figure is a count of journeys, not people. A frequent international traveler appears in the archive once for each flight, often with passport details and a seat number attached. That reframes the exposure for any one individual: a Canadian who flew to Hanoi, Singapore, and Frankfurt in 2019 would account for three separate rows, and the same passport number, date of birth, and issuing country would repeat three times. The discoverer's writeup and the corroborating outlets describe the cache as records rather than unique individuals, but the per-journey math has not always traveled with the headline number.
The data inside the archive goes well beyond what most travelers think of as a name and an email. Each row carried the passenger's full name, sex, date of birth, nationality, passport or travel-document number, document expiration date, and the country that issued the document. The rows also carried the airline, the departure, destination, and transit airports, the seat assignment, and a baggage reference number. Seat assignments and baggage numbers are not normally part of publicly available travel data, and their presence points to a downstream system that retained operational detail rather than a stripped-down government feed.
Multiple airlines are represented in the dataset, and at least four nationalities are confirmed in the source writeup: Canadians, Chinese, Koreans, and New Zealanders. Other travelers are clearly in the data, but the published discovery did not enumerate them. The archive has since been locked down. As of early June 2026, Bleeping Computer reported no evidence that the data had been listed for sale on dark-web markets. Three months later, no follow-up sale has surfaced in the corroborating coverage, though the absence of a listing is not the same as the absence of access.
The operator of the database has not been publicly identified. The cluster's IP address belonged to a block assigned to Viettel, Vietnam's state-owned telecoms company, which places the server in Hanoi but does not say who was running it. That question matters because the responsibility for a misconfigured APIS archive, and the obligation to notify the data-protection authorities in the countries whose citizens are in the file, normally falls on whoever operates the system. The discoverer's writeup, and the four outlets that have corroborated it, do not name that operator.
The failure here was not a sophisticated intrusion. It was a default username and password on a cloud-based path into a database that should never have been reachable from outside the operating organization's network, and that held the most sensitive category of travel data governments collect. The window the database was potentially reachable spans the full nine years the archive covers. Until the operator is named, the audit trail of who had access and when, and the notification chain to the affected data-protection authorities, will not be visible to the public.