220M TRAVELER RECORDS EXPOSED IN VIETNAM-LINKED APIS LEAK

Summary from the TLDR InfoSec newsletter

Security researchers gained access to an Elasticsearch cluster containing an Advanced Passenger Information System (APIS) database with records belonging to 220M passengers and flight crew members. The researchers received a 401 when trying to access the cluster via the public internet but could reach the database, which accepted default credentials via a cloud-based access path. The data includes passengers' and crew members' names, dates of birth, sex, nationalities, passport or travel document numbers, document expiration dates, and issuing countries.