Feed: Slashdot
Feed Link: https://slashdot.org/
---

Title: 220 Million Traveler Records Exposed In Vietnam-Linked APIS Leak

Link: https://yro.slashdot.org/story/26/09/12/17582...

A misconfigured Advance Passenger Information System (APIS) database linked
to Vietnam exposed more than 220 million passenger and crew travel records
spanning 2017 to 2026, including names, passport numbers, nationalities,
flight details, seat assignments, and baggage references. Researchers said
the database was reachable through a chain of security mistakes and default
credentials. It was later secured after the disclosure, but it's unclear
whether the data had already been copied or abused. BleepingComputer reports:
Kinryu Labs discovered the Elasticsearch cluster on June 3 while surveying
exposed databases as part of research into ransomware activity. The cluster,
named 'pax-info', contained 29 indices and roughly 107 GB of data. Its two
principal indices held 210,318,069 passenger records and 10,465,631 crew
records, for a combined 220,783,700 entries. According to Kinryu Labs, the
cluster was hosted in Viettel-assigned IP space in Hanoi. BleepingComputer
could not confirm which Vietnamese organization operated the system. The
exposed information included passengers' and crew members' names, dates of
birth, sex, nationalities, passport or travel-document numbers, document
expiration dates, and issuing countries. Associated travel data included
flight numbers and dates, airlines, departure, destination and transit
airports, seat assignments, baggage references, and scheduled, estimated, and
actual flight times, information typically carried by APIS and related
airline systems. Sample records reviewed by BleepingComputer included
travelers of Korean, Chinese, Canadian, and New Zealand nationality, among
others. While the researchers could not provide a complete breakdown by
nationality, the data covered numerous international airlines across Asia-
Pacific, Europe, and the Middle East. As a result, the exposed records could
relate to people from virtually anywhere who visited or transited through
Vietnam over the nine-year period. Kinryu Labs expects to publish additional
details on its blog later this week.

Read more of this story at Slashdot.

---
VRSS v2.1.180528