APIS Misconfigs Threaten Global Traveler Privacy

A misconfigured Advance Passenger Information System (APIS) cluster exposed roughly 220.8 million passenger and crew records from 2017–2026, including names, passport numbers, travel itineraries, seat and baggage data. The dataset was found by security researchers in Viettel‑assigned IP space and was reachable via default credentials and other basic security lapses. — Exposed travel manifests of this scale show that routine operational security failures in national or vendor‑hosted border systems create cross‑border privacy and security risks that merit policy, oversight, and international coordination.