Researchers found an exposed APIS database containing more than 220 million passenger and crew records, including passport numbers, flight details, and other sensitive travel information tied to travel to, from, or through Vietnam. The exposure was traced to chained security misconfigurations and was later remediated, but it is still unclear whether the data was accessed, copied, or sold before it was secured. #APIS #KinryuLabs #Viettel #SingaporeAirlines #ChangiAirportGroup
Keypoints
- An exposed APIS database held more than 220 million passenger and crew records.
- The records included names, passport numbers, birth dates, and detailed flight information.
- The data spanned January 2017 to April 2026 and involved travelers linked to Vietnam.
- Researchers reached the cluster through chained misconfigurations and default credentials.
- The database was remediated, but it remains unknown whether the data was stolen or sold.