[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA2Oi0gEhXoYnH3oSMxODtcv3OrkWmgr_DYxhjZIPRW4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":27,"status":28,"created_at":29,"published_at":30,"article":31,"tags":35,"podcasts":54,"controls":55},"67289589-ee6b-4974-8b61-c3fc9dbd4b52","default-credentials-expose-220-million-traveler-records-in-apis-database-leak","2b63b399-a4e4-4fc0-aa44-c96777863a88","Default Credentials Expose 220 Million Traveler Records in APIS Database Leak","An Advance Passenger Information System (APIS) database was left publicly accessible due to a combination of security misconfigurations and the use of default credentials, exposing 220 million sensitive passenger and crew records spanning nearly a decade. This failure highlights how foundational security hygiene — particularly changing default credentials and restricting public access to sensitive databases — remains critically neglected even in systems handling highly sensitive personal and travel data. The exposure of passport numbers, dates of birth, and flight details creates significant risk for identity theft, targeted phishing, and potential surveillance of travelers across multiple nationalities. The incident underscores that databases containing personally identifiable information (PII) must never be internet-facing without strong authentication, encryption, and access controls in place.","**Immediate actions:**\n- Audit all internet-facing databases and systems immediately to identify any use of default or weak credentials and replace them with strong, unique passwords.\n- Restrict public internet access to sensitive databases by placing them behind firewalls, VPNs, or private network segments with explicit allowlisting.\n- Conduct an inventory scan of all exposed assets using tools like Shodan or internal vulnerability scanners to identify unintended public exposure.\n\n**Long-term improvements:**\n- Implement a mandatory hardening checklist for all new system deployments that explicitly requires changing default credentials before go-live.\n- Adopt a data minimization and classification policy to ensure that highly sensitive PII databases receive the highest tier of access controls and monitoring.\n- Establish a regular third-party penetration testing and security audit program focused on externally accessible infrastructure.\n\n**Detection measures:**\n- Deploy continuous monitoring and alerting on database access logs to detect anomalous query volumes or unauthorized access attempts in real time.\n- Integrate threat intelligence feeds and external attack surface management (EASM) tools to proactively identify misconfigured or exposed assets before researchers or attackers do.\n- Set up a responsible disclosure (bug bounty) program so that external security researchers have a clear, trusted channel to report vulnerabilities promptly.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 5: Account Management (elimination of default credentials)","CIS Control 12: Network Infrastructure Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","GDPR Article 5(1)(f): Integrity and Confidentiality","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing","ISO\u002FIEC 27001:2022 A.8.9: Configuration Management","ISO\u002FIEC 27001:2022 A.8.20: Networks Security","ITIL 4: Change Enablement (configuration baseline management)",{},"published","2026-09-08T08:20:36.148798+00:00","2026-09-08T08:20:36.011+00:00",{"id":7,"url":32,"slug":33,"title":34},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002F220-million-traveler-records-exposed-in-vietnam-linked-apis-leak\u002F","220-million-traveler-records-exposed-in-vietnam-linked-apis-leak-0d6572","220 million traveler records exposed in Vietnam-linked APIS leak",[36,42,48],{"id":37,"name":38,"slug":39,"description":40,"color":41},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":43,"name":44,"slug":45,"description":46,"color":47},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":49,"name":50,"slug":51,"description":52,"color":53},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[56,60,64],{"slug":57,"name":58,"problem":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":61,"name":62,"problem":63},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":65,"name":66,"problem":67},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak."]