Nine years of passport numbers and seat assignments, on a server with default credentials
Every time you fly internationally, the airline files a set of details about you with the destination country before the aircraft leaves. That system is called APIS, Advance Passenger Information System, and it is about as sensitive a pile of data as exists outside a bank. Kinryu Labs found one of them sitting on the open internet on 3 June, while sweeping for exposed databases. It held 220.8 million records: 210.3 million passengers and 10.5 million crew, roughly 107GB across 29 indices, on IP space assigned to Viettel in Hanoi.
The contents are not a partial leak. Names, dates of birth, sex, nationality, passport or travel document number, its expiry date and issuing country, then flight number and date, airline, departure, destination and transit airports, seat number, baggage reference and the scheduled, estimated and actual times. The records run from January 2017 to April 2026, and cover travellers on airlines across Asia-Pacific, Europe and the Middle East who flew to, from or through Vietnam in that window. Getting in required chaining two mistakes: a cloud path that bypassed the login, and then default credentials that had never been changed. Kinryu Labs reported it the day it was found and access was closed on 8 June, with help from Vietnamese authorities and airlines.
What nobody can tell you is whether anyone else got there first. The researchers found no ransom notes and no sign of tampering, but there were no server logs either, so "we found no evidence" is as far as it goes. A passport number is not a password; you cannot rotate it, and it stays valid for years. The realistic risk is not that someone books a flight as you. It is that a message naming your airline, your seat and the exact date you flew is extremely convincing, and no airline or border agency ever asks you to confirm passport details by email or text about a trip you already took.
Most of us also keep our own copy of all this: passport scans, boarding passes and visa letters sitting in Documents. Tendvane's security-posture check tells you whether BitLocker is actually switched on for that drive and nudges you to save the recovery key somewhere other than the machine it unlocks.