An Elasticsearch cluster holding 220 million passenger and crew records was reachable using credentials nobody had changed. The entries run from January 2017 to April 2026, and no operator has claimed the database.
On 8 September, BleepingComputer reported that researchers at Kinryū Labs had found an exposed Elasticsearch cluster holding more than 220 million passenger and crew records. The researchers found it on 3 June during a broad survey of databases left open on the internet, and published their own account of the exposure. The cluster was named pax-info. It held 220,783,700 documents across 29 indices, roughly 107 GB, and it accepted the Elasticsearch default username and password, which the operator had never changed. Access was closed on 8 June.
The two largest indices held 210,318,069 passenger records and 10,465,631 crew records, covering 7 January 2017 through 30 April 2026. Each entry paired a full name, date of birth, sex and nationality with a passport or travel document number, its expiry date and issuing country, then the flight itself: number, date, departure and destination airports, transit airports, seat number and baggage tag. Kinryū Labs counted 1,008 airlines in the data. VietJet Air accounted for 45.8 million records and Vietnam Airlines for 43.2 million, and crew entries included carriers such as Aeroflot and Belavia.
The structure matches an Advance Passenger Information System, or APIS. Airlines are required to transmit identity, passport and flight details to border authorities before a flight departs or arrives, so that passengers and crew can be screened before they land. The scheme is in use worldwide. For the people in the index, the record exists because a government required the airline to send it, which means none of them agreed to it, chose the handler, or knew how long it would be kept.
The cluster was not sitting wide open. A request sent to it directly from the internet was refused with an HTTP 401. Kinryū Labs reached it from a cloud vantage point instead, and from there the factory-set credentials worked; the cluster's own web interface then offered a one-click JSON export. The server sat in address space assigned to Viettel, a state telecommunications operator in Hanoi. Singapore Airlines, whose passengers appeared in the data, told BleepingComputer on 8 June that its security team had "engaged the relevant parties" and taken steps to contain the issue.
Three months after the exposure was closed, the operator of the database is still unconfirmed. A company that loses customer data has an obligation to notify the people affected, and a name to put on the letter. Here there is no identified controller, so there is no notification, no deletion request to file and no way for any of the 220 million people in the index to find out whether one of their trips is in it. The window in which the data was retrievable has closed; the retention has not. A passport number stays valid for years, and it keeps pointing at the same person, at the same date of birth, with the same travel history attached.
No operator has claimed the database, so nobody has to tell the 220 million people inside it.
This is the second exposure in two weeks built out of identity documents rather than passwords, after the dark web listing of ID scans we wrote about last week. Border reporting is not something a storage product replaces; an airline has to send the manifest. But a large share of the sensitive documents people move around has nothing to do with a border. The passport page a visa agency asks for, the scan a landlord wants, the itinerary an employer needs for an expense claim: those usually travel as a mail attachment or a shared drive link, and each one leaves another readable copy in another company's system, retained on a schedule nobody explained.
SpaceBox Lite is built so that the transfer step does not add one. Files are encrypted on the sender's device with AES-256-GCM, and the key is wrapped using post-quantum ML-KEM-768 (NIST FIPS 203). Private keys stay on the device, our servers hold ciphertext only, and a sender needs no account and gives us no personal data. Post-quantum key exchange is available from several vendors now, and the part that matters for this story is plainer than the cryptography: an exposed SpaceBox store returns bytes that nobody, including us, can read. The free tier covers 1 MB, one sender and three files, and a free voucher at beta.i46.space adds 100 MB and 100 files (email required). SpaceBox Lite is not available to EU and EEA residents during the beta. Why SpaceBox covers the rest of the design.
The default password on that cluster was changed in five days. The nine years of passport numbers it was holding will be accurate for a good deal longer.