Massive APIS Data Leak Exposes Over 220 Million Flight Records Linked to Vietnam

An extensive data breach has revealed more than 220 million traveler and crew records from an Advance Passenger Information System (APIS) tied to Vietnam, covering the period from 2017 through 2026. The exposed information includes full names, passport numbers, dates of birth, nationalities and detailed flight itineraries, creating one of the largest known compromises of aviation‑related personal data.

APIS is a mandatory data‑collection platform used by airlines and border authorities worldwide to transmit passenger details before departure or arrival, enabling security checks and immigration processing. The compromised database appears to be part of a Vietnam‑linked implementation of the system. Security researchers say they accessed the repository after discovering it was left publicly reachable without authentication, allowing them to download the full dataset without triggering alerts.

The scale of the leak raises serious privacy concerns. With passport numbers and travel histories exposed, affected individuals could become targets for identity theft, fraud or more sophisticated social‑engineering attacks. Aviation experts note that while passenger data is routinely shared among governments for security purposes, it is normally protected by strict safeguards; the breach highlights how a single misconfiguration can jeopardize the personal information of millions across multiple jurisdictions.

Vietnamese authorities and the airlines involved have acknowledged the incident but have provided limited details pending a formal investigation. Officials have indicated that they are working with cybersecurity teams to assess the breach’s scope, secure the vulnerable system and notify affected parties in accordance with international data‑protection regulations. Regulators in several countries have signaled intent to review compliance with APIS security standards, and some have already urged airlines to conduct comprehensive audits of their data‑handling practices.

The incident arrives amid growing scrutiny of how passenger data is stored and shared globally. Industry groups are calling for stronger encryption, stricter access controls and regular third‑party security assessments to prevent similar exposures. Travelers are advised to monitor their credit reports and remain vigilant for suspicious activity, although the direct financial risk from the leak remains uncertain. As investigations continue, the episode serves as a stark reminder that even well‑established security infrastructures can be vulnerable when basic safeguards are overlooked.