The Data You Gave Away: What 220 Million Exposed Traveler Records Mean for Your Board

Every time one of your employees boards an international flight, their passport number, date of birth, and full itinerary flow into a foreign government database. It is a legal requirement. Airlines transmit this data through Advance Passenger Information Systems, or APIS, before the plane pushes back from the gate. Your employees have no choice, and neither do you.

What happens to that data after it lands? Until this month, most executives had never asked the question. Now they should.

Nine Years of Passports, One Default Password

On September 8, security firm Kinryu Labs publicly disclosed that an Elasticsearch database holding APIS records for Vietnam had been sitting exposed on the internet, reachable through a chain of misconfigurations and protected by nothing more than default credentials. The database, named "pax-info," contained 210,318,069 passenger records and 10,465,631 crew records — more than 220 million entries spanning January 2017 to April 2026.

Each record paired a name, date of birth, and passport number with a full travel itinerary down to the seat assignment and baggage tag. The data covered travelers of many nationalities — Korean, Chinese, Canadian, New Zealand, and others — anyone who flew to, from, or through Vietnam over those nine years. Kinryu Labs discovered the exposure on June 3, 2026. The cluster was secured five days later. But no Vietnamese organization has publicly claimed ownership of the database, and no one can confirm whether the data was copied before the door was closed.

Let that land for a moment. Nine years of passport data. Default credentials. And nobody will say whose system it was.

The Risk You Cannot Manage

This is a category of data exposure that most enterprise risk programs do not account for. Your CISO's risk register probably tracks your cloud infrastructure, your SaaS vendors, maybe even your fourth-party suppliers. But the data your employees surrender to foreign governments as a condition of travel? That is almost certainly not on anyone's dashboard.

It should be.

In Cyber Risk Is Business Risk, I write about the Three Questions every board should be able to answer: What data do we have? Who can access it? And what are we doing to protect it? The Vietnam APIS exposure adds an uncomfortable fourth: What data have we given away that we can no longer protect at all?

This is not a theoretical concern. If your company has employees who travel internationally — and most do — their passport numbers, dates of birth, and travel patterns are sitting in government databases across dozens of countries. The security posture of those systems is entirely outside your control. You cannot audit them. You cannot patch them. You cannot even confirm they exist until a researcher stumbles across one answering on its default login.

The Board Conversation That Needs to Happen

The instinct here is to shrug. The data was mandated by law. There was nothing the company could have done to prevent the collection. And that is true — as far as it goes. But fiduciary duty does not stop at the things you can prevent. It extends to the things you can prepare for.

If 220 million passport records are floating around from a single country's misconfigured database, the question is not whether your employees' travel documents have been compromised. The question is what happens next.

Passport fraud. Targeted spear-phishing using real itinerary data. Social engineering attacks that reference actual travel dates and destinations. Intelligence-grade tracking of executive movements. These are not speculative risks. They are the operational consequences of a dataset that pairs identity documents with detailed travel histories.

Here is what to ask your CISO this week:

Do we have a travel-data exposure policy? Most organizations track what data they collect. Few track what data they are required to surrender. Your risk program should include a register of mandatory data-sharing obligations — APIS, customs declarations, visa applications — and the countries involved.

Are we monitoring for exposed employee credentials beyond our own perimeter? Dark web monitoring services increasingly scan for passport data, not just email-password pairs. If your executives' passport numbers surface in a breach dump, you need to know before the attackers start using them.

What is our incident response plan for identity document compromise? When an employee's corporate password leaks, you reset it. When their passport number leaks, the remediation path is far more complex and far more expensive. Do you have a process for it?

Compliance Is Not Security — Again

The Vietnam APIS exposure is a textbook illustration of a theme I return to throughout Cyber Risk Is Business Risk: compliance and security are not the same thing. Vietnam's APIS system existed to comply with international aviation security mandates. Airlines transmitted data to it because they were required to. And yet the system holding that data was protected by default credentials for what may have been years.

This pattern repeats everywhere. Organizations build systems to satisfy a regulatory checkbox, then underfund the operational security that keeps those systems from becoming liabilities. The checkbox gets checked. The auditor signs off. And the Elasticsearch cluster sits there, answering to anyone who tries the factory password.

For boards, the lesson is direct: when your management team reports that the company is "in compliance," the follow-up question must always be, "Compliant with what standard, and what does that actually protect?" Because in this case, the system was fully compliant with APIS data-transmission requirements. It was also fully exposed to anyone with a web browser and a guess.

What Comes Next

The APIS exposure is unlikely to be an isolated case. Governments around the world collect enormous volumes of biometric and identity data from travelers, and the security standards governing those systems vary wildly. The International Civil Aviation Organization and the World Customs Organization publish guidelines for APIS data handling, but compliance is voluntary and enforcement is nonexistent in many jurisdictions.

Your board does not need to become an expert in foreign data-protection regimes. But it does need to understand that the company's data footprint extends far beyond the systems it owns, and that some of those external repositories carry risks that no vendor assessment or penetration test will ever reach.

The 220 million records in Vietnam are a warning. The data you gave away is the data you cannot get back.