Overview
- Kinryū Labs found the Elasticsearch cluster named “pax-info” on June 3 and reported it to Vietnamese authorities, affected airlines and national CERTs after verifying the data.
- Researchers say the archive held 29 indices totaling about 107 GB and 220,783,700 travel records that span January 2017 through April 2026.
- Access was possible by chaining two configuration failures: a public endpoint that returned HTTP 401 plus a cloud-based path that accepted default credentials.
- The server sat in IP space assigned to Viettel in Hanoi but investigators could not identify who operated the system; access was remediated on June 8 with Singapore Airlines helping coordinate the response.
- No ransom notes or public sales were found but the lack of server logs prevents researchers from ruling out data copying, and exposed fields such as passport numbers and birthdates raise clear risks of identity theft and travel fraud.