220 million traveler records exposed in Vietnam-linked APIS leak

An Advance Passenger Information System (APIS) database was left publicly accessible due to a combination of security misconfigurations and the use of default credentials, exposing 220 million sensitive passenger and crew records spanning nearly a decade. This failure highlights how foundational security hygiene — particularly changing default credentials and restricting public access to sensitive databases — remains critically neglected even in systems handling highly sensitive personal and travel data. The exposure of passport numbers, dates of birth, and flight details creates significant risk for identity theft, targeted phishing, and potential surveillance of travelers across multiple nationalities. The incident underscores that databases containing personally identifiable information (PII) must never be internet-facing without strong authentication, encryption, and access controls in place.