Full Report
Exclusive: An exposed Advance Passenger Information System (APIS) database held 220 million passenger and crew records containing names, passport numbers, dates of birth, nationalities, and flight details spanning 2017 to 2026. Researchers accessed the Vietnam-linked system through a cloud-based path using default credentials. [...]
Analysis Summary
# Incident Report: Vietnam-linked APIS Database Exposure
## Executive Summary
A misconfigured Elasticsearch database containing over 220 million passenger and crew records was discovered exposed on the open internet. The Advance Passenger Information System (APIS) data, linked to a Vietnamese entity, included sensitive PII such as passport numbers, flight details, and full names spanning a nine-year period (2017–2026). The exposure was remediated following a coordinated disclosure by security researchers, though it remains unconfirmed if malicious actors accessed the data prior to discovery.
## Incident Details
- **Discovery Date:** June 3, 2026
- **Incident Date:** Exposure recorded as early as October 2022; remediated June 8, 2026.
- **Affected Organization:** Unknown Vietnamese-linked organization (hosted in Viettel IP space).
- **Sector:** Aviation / Government (Advance Passenger Information System).
- **Geography:** Vietnam (Hanoi).
## Timeline of Events
### Initial Access
- **Date/Time:** Identified by FOFA in October 2022; discovered by Kinryū Labs on June 3, 2026.
- **Vector:** Chained misconfigurations (Publicly accessible cloud-based path).
- **Details:** While the primary endpoint returned a 401 Unauthorized error, a secondary cloud-based path allowed access to the cluster.
### Lateral Movement
- **Details:** N/A; The incident involved a direct exposure of a data cluster rather than an intrusion into a corporate network.
### Data Exfiltration/Impact
- **Details:** 107 GB of data consisting of 210.3 million passenger records and 10.4 million crew records. Data included names, DOB, passport numbers, nationalities, and granular flight details (seat assignments, baggage references).
### Detection & Response
- **Discovery:** June 3, 2026, by researchers at Kinryū Labs during a survey of exposed databases.
- **Response Actions:** Researchers notified Vietnamese authorities, affected airlines, and national CERTs. Singapore Airlines coordinated with relevant parties to secure the system. Access was remediated by June 8, 2026.
## Attack Methodology
- **Initial Access:** Exploitation of a secondary cloud-based path bypassing the primary authentication prompt.
- **Persistence:** N/A (Data exposure).
- **Privilege Escalation:** N/A.
- **Defense Evasion:** N/A.
- **Credential Access:** Use of **default credentials** on the Elasticsearch cluster.
- **Discovery:** Internet-wide scanning for exposed Elasticsearch indices (Cluster name: 'pax-info').
- **Lateral Movement:** N/A.
- **Collection:** Automated querying of 29 indices within the cluster.
- **Exfiltration:** Potential unauthorized downloading (unconfirmed due to lack of logs).
- **Impact:** Exposure of massive volumes of PII and travel history.
## Impact Assessment
- **Financial:** Potential for regulatory fines (GDPR/local data laws) and costs associated with identity theft monitoring.
- **Data Breach:** High volume (220M+ records) of highly sensitive PII, including passport numbers and travel patterns.
- **Operational:** Low; the system remained functional, but required emergency remediation.
- **Reputational:** Significant impact on the trust of international travelers and airlines transiting through Vietnam.
## Indicators of Compromise
- **Network Indicators:**
- Host/Port identified in Viettel-assigned IP space (Hanoi).
- Cluster name: `pax-info`.
- **Behavioral Indicators:**
- HTTP 401 responses on primary endpoints with open access via alternative cloud paths.
- Usage of default Elasticsearch credentials.
## Response Actions
- **Containment:** The database was taken offline/secured on June 8, 2026.
- **Eradication:** Removal of the secondary cloud-based access path and updating of default credentials.
- **Recovery:** Coordination with international airline security teams (e.g., Singapore Airlines) to validate data integrity.
## Lessons Learned
- **Key Takeaways:** Even if a primary interface appears secure (401 Unauthorized), secondary paths or misconfigured cloud gateways can bypass security controls.
- **Deficiencies:** The use of default credentials on a production database containing sensitive international travel data represents a critical failure in basic security hygiene.
- **Visibility:** The lack of server logs prevented researchers from confirming if the data had been stolen by malicious actors.
## Recommendations
- **Credential Management:** Strictly enforce a policy against the use of default credentials for all database clusters.
- **Network Hardening:** Ensure all cloud paths and API gateways are subject to the same authentication requirements as the primary endpoint.
- **Encryption at Rest:** Encrypt sensitive fields (like passport numbers) within the database to mitigate impact in the event of an exposure.
- **Monitoring:** Implement alerting for databases exposed to the public internet and maintain robust access logs for forensic analysis.