[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-airline-database-leak-exposes-220-million-traveler-records":10,"sections":50},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":39,"tags":40,"sources":45,"feedback":49,"feedback_at":22,"cost_usd":49,"total_tokens":49},6180,"airline-database-leak-exposes-220-million-traveler-records","Airline Database Leak Exposes 220 Million Traveler Records","A misconfigured Vietnam-hosted database left 210 million passenger records and 10.5 million crew records from nine years of flights exposed online.","A misconfigured cloud database left nine years of airline travel records sitting open on the internet.\n\nSecurity researchers at Kinryu Labs found an Elasticsearch cluster hosted in Hanoi, Vietnam, that was technically walled off from the open internet but reachable through a cloud-based side door - and once inside, the cluster accepted default login credentials. The archive held 29 indices totaling roughly 107GB, generated by an Advance Passenger Information System that airlines use to report traveler data to border authorities. Two indices dwarfed the rest: 210 million passenger records and 10.5 million crew records, dated between January 2017 and April 2026, covering names, birth dates, passport numbers, seat assignments, and baggage references for people who passed through Vietnam on airlines across Asia-Pacific, Europe, and the Middle East. Researchers could not identify who owned the database, so they alerted Vietnamese authorities and the affected airlines on June 3; the archive was locked down five days later, with Singapore Airlines' security team leading the response.\n\nThis wasn't a hack - it was a door left unlocked for nine years. The scale means anyone who flew through Vietnam since 2017, on any of dozens of carriers, may have had passport and travel details sitting exposed, with no way to confirm who found it first without a full forensic audit that hasn't happened.\n\nNo evidence has surfaced of the data being sold or used anywhere, which is the one bit of good news here. But \"no evidence yet\" is doing a lot of work in that sentence - this is the same misconfigured-cloud-database story that exposed 670 million records at Infutor and three billion at IDMerit earlier this year, just with passports and boarding passes instead of credit histories.","[\"data breach\",\"aviation\",\"cloud security\",\"vietnam\"]","2026-09-08T20:40:00.000Z","2026-09-08T21:12:01.364Z","2026-09-08T21:12:13.277Z","published",null,[24,30,35],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Fix the trend paragraph: IDMerit's leak was over 3 billion records (not 'hundreds of millions'), so the combined Infutor+IDMerit total is in the billions — correct the figures to match the source instead of understating them.","resolved",{"id":31,"reviewer":32,"round":33,"reason":34,"status":29},"publisher-r2","publisher",2,"The dek claims the database was left 'sitting open on the internet,' but the body directly contradicts this by stating it 'wasn't directly exposed to the open internet' and was only reachable through a cloud-based route with default credentials.",{"id":36,"reviewer":26,"round":37,"reason":38,"status":29},"editor-r3",3,"The headline claims '220 Million Airline Passenger Records' but the body clarifies the total is actually 210 million passenger entries plus 10.5 million crew entries — fix the headline (and dek if needed) to reflect that crew records are included, not just passengers.","security",[41,42,43,44],"data breach","aviation","cloud security","vietnam",[46],{"name":47,"url":48},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fmassive-data-breach-sees-220-million-traveler-records-exposed-nine-years-of-airline-info-leaked-including-passenger-and-passport-details",0,{"sections":51},[52,57,60,65,70,75,80,84,89,94,99,104,109,114],{"name":53,"slug":54,"count":55,"latest_published_at":56},"AI","ai",3480,"2026-09-11T04:00:00.000Z",{"name":58,"slug":39,"count":59,"latest_published_at":56},"Security",629,{"name":61,"slug":62,"count":63,"latest_published_at":64},"Policy","policy",336,"2026-09-11T00:56:21.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Hardware","hardware",153,"2026-09-09T15:12:32.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Consumer Tech","consumer-tech",99,"2026-09-09T17:27:33.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":56},"Science","science",98,{"name":85,"slug":86,"count":87,"latest_published_at":88},"Software","software",75,"2026-09-10T20:41:21.000Z",{"name":90,"slug":91,"count":92,"latest_published_at":93},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":95,"slug":96,"count":97,"latest_published_at":98},"Startups","startups",55,"2026-09-09T23:14:29.000Z",{"name":100,"slug":101,"count":102,"latest_published_at":103},"Gaming","gaming",43,"2026-09-10T12:18:06.000Z",{"name":105,"slug":106,"count":107,"latest_published_at":108},"General","general",41,"2026-09-08T01:57:23.000Z",{"name":110,"slug":111,"count":112,"latest_published_at":113},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":115,"slug":116,"count":117,"latest_published_at":118},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]