220 Million Traveler Records Were Left Behind With Default Credentials
- The Mess: A Vietnam-linked passenger information system exposed more than 220 million traveler and crew records through a cloud-accessible database protected by default credentials.
- The Damage: Names, passport numbers, dates of birth, nationalities and detailed flight information covering almost a decade were exposed.
- The Fix: Never expose administrative database infrastructure with default credentials, and continuously scan cloud assets for unintended public access.
This was not a sophisticated zero-day.
No ransomware crew needed to break through a hardened airport network.
Researchers found a massive Advance Passenger Information System (APIS) database sitting behind a cloud-accessible path with default credentials.
Inside were more than 220 million passenger and crew records covering travel from 2017 through 2026.
The data included names, passport numbers, dates of birth, nationalities and flight information.
That’s not a database leak.
That’s an identity-theft starter pack.
220 Million Records
The exposed system contained information collected through an APIS platform linked to Vietnam.
APIS systems are designed to handle passenger information supplied to authorities and airlines before travelers arrive at a destination.
That makes the dataset particularly sensitive.
A random marketing database might contain an email address.
This one contained information that can be tied directly to a person’s identity and movements.
Passport numbers.
Birth dates.
Nationality.
Flight information.
Potentially enough information to make targeted phishing considerably more convincing.
The records reportedly covered flights between January 2017 and April 2026.
The Password Was the Problem
The researchers did not need an exotic exploit.
They reached the database through a cloud-based access path using default credentials.
That detail is almost embarrassing.
Organizations spend millions securing perimeter infrastructure while leaving a cloud management interface protected by credentials that were never changed.
No zero-day.
No SQL injection.
No malware.
Just a default password.
The result was a database containing hundreds of millions of records becoming accessible to researchers.
This Is Why Cloud Exposure Keeps Winning
The database was not necessarily sitting openly on the internet with a giant sign saying “download me.”
The problem was the combination of cloud exposure and weak authentication.
That’s increasingly common in modern infrastructure.
A company can have:
- firewalls;
- endpoint protection;
- SIEM;
- MFA;
- vulnerability scanners;
and still expose an internal database because someone created a cloud endpoint months ago and forgot about it.
Traditional perimeter security does not solve that.
The database is already outside the perimeter.
The Damage Goes Beyond Names
Passenger information has an unusual value.
Knowing someone’s name is useful.
Knowing their passport number is much better for an attacker.
Knowing their date of birth and nationality adds another layer.
Knowing where they traveled creates context.
An attacker can combine those details with breached email addresses, social-media information and other stolen databases to build extremely convincing identity-based attacks.
A phishing email saying:
“Your flight from Hanoi to Singapore was cancelled.”
is far more believable when the attacker actually knows that you took that route.
The breach therefore creates opportunities beyond simple database resale.
The Timeline Matters
The exposed data reportedly covered almost ten years of travel information.
Researchers later reported that access to the exposed system was closed on June 8, but the records may have been accessible before remediation and could potentially have been copied.
That’s the problem with public exposure.
You can close the database today.
You cannot retroactively erase everything somebody may have downloaded yesterday.
And once sensitive data is copied, the original server can disappear completely without eliminating the risk.
No Hacker Needed
There is an important lesson here for defenders.
The attack chain was effectively:
Cloud exposure → default credentials → database access → 220M records
That’s it.
No exploit development team required.
No advanced persistence.
No privilege escalation.
No ransomware.
Just a configuration failure sitting underneath a gigantic dataset.
This is exactly why external attack-surface management matters.
You cannot protect an asset you don’t know is exposed.
Bugstoday Opinion
The cybersecurity industry loves complicated attacks.
Supply-chain compromises.
Zero-days.
AI-powered malware.
Exploit chains nobody understands without a debugger.
But sometimes the attacker just tries:
admin / default-password
And gets 220 million travel records.
That’s not a failure of cryptography.
It’s not a failure of artificial intelligence.
It’s not even a particularly clever hack.
It’s a failure to change the password and notice that a sensitive database was reachable from the outside.
The most expensive vulnerability in the system was apparently the one nobody bothered to configure.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- BleepingComputer — Vietnam-linked APIS database exposure
- Kinryū Labs — APIS database exposure research
- CyberHappenings — Exposure timeline and dataset analysis
