Vietnam Airlines Data Breach (2025): What Was Exposed & What To Do

For millions of Vietnam Airlines customers, the exposure of personal details can mean more than a distant cybersecurity headline. When names, contact information, dates of birth and loyalty programme records leave an organisation’s systems, the practical stakes include targeted phishing, account takeover attempts and the long-term risk that those details will be reused in fraud. Public reporting indicates that 7.3 million unique customer email addresses were among the records involved, making the incident relevant to a large share of the airline’s passenger base.

The data became public in October 2025 after it was stolen from Salesforce environments used by multiple companies. Vietnam Airlines was named among the organisations affected. Exact methods of initial access remain limited in public detail, yet the volume and nature of the records make clear why ordinary travellers and loyalty members have reason to pay attention.

What happened

According to public reporting, a breach of Vietnam Airlines’ Salesforce environment occurred in June 2025. The incident was reported on 20 June 2025. In October 2025, data stolen from the Salesforce instances of multiple companies was publicly released by a hacking group calling itself “Scattered LAPSUS$ Hunters.” Vietnam Airlines was listed among the affected organisations. The release included 7.3 million unique customer email addresses together with associated personal details. Public sources do not provide further confirmed information on the precise intrusion technique, the full duration of unauthorised access, or any ransom demand. The scale of the email exposure is the clearest quantitative figure available.

Inside shinyhunters

ShinyHunters is a well-documented cybercriminal group that has operated for several years, specialising in large-scale data theft and the subsequent sale or public dumping of stolen databases. The group is known for targeting cloud platforms, customer-relationship systems and other repositories that hold high volumes of personal and commercial data. Its typical tactics have included social-engineering campaigns against employees, exploitation of misconfigured cloud services, and the use of stolen credentials. Prior activity attributed to the group has involved breaches of technology, retail and service companies, with data often appearing on underground forums or leak sites. In the present case the public release was claimed by actors identifying themselves as “Scattered LAPSUS$ Hunters”; that listing remains an unverified claim by the group rather than an independently confirmed attribution. Public knowledge of ShinyHunters’ methods supplies context for how such Salesforce-related incidents commonly unfold, but does not establish additional specifics about the Vietnam Airlines intrusion beyond what has been reported.

About Vietnam Airlines

Vietnam Airlines is the national flag carrier of Vietnam, operating extensive domestic and international passenger and cargo services. Like other major airlines, it maintains large customer databases that support booking systems, frequent-flyer programmes, customer-service platforms and marketing operations. These systems routinely store contact details, travel histories and loyalty membership information. Because airlines sit at the intersection of travel, identity verification and commercial loyalty schemes, a compromise of their customer records can affect both individual travellers and the organisation’s operational trust. The use of Salesforce as a customer-data platform is common across the sector; any breach of that environment therefore carries consequences for the volume of personal information typically concentrated there.

What data was at risk

Public reporting names the following categories of data as exposed: dates of birth, email addresses, loyalty programme details (including membership numbers), names and phone numbers. The figure of 7.3 million unique customer email addresses is the only scale metric confirmed in the available summary. No further breakdown of file contents, exact record counts beyond the email total, or confirmation of additional data types has been disclosed. Organisations of this type commonly hold passport or identity-document references, payment-token information and detailed travel itineraries; whether any of those elements were present in the stolen Salesforce data remains unconfirmed. Readers should therefore treat only the named categories as established and regard other possibilities as speculative.

Why it matters

For individuals, the combination of name, date of birth, email, phone number and loyalty membership number creates a ready-made profile for social-engineering attacks. Fraudsters can craft convincing messages that reference genuine loyalty accounts or recent travel, increasing the chance that recipients will click malicious links or disclose further credentials. Phone numbers and emails also enable SIM-swap attempts or credential-stuffing attacks against other services where the same contact details are reused. For Vietnam Airlines the incident raises operational and reputational considerations: customer trust, potential regulatory scrutiny under data-protection regimes, and the cost of remediation and notification. Because the data were released publicly rather than merely held for ransom, the exposure is effectively permanent; once circulating, the records can be copied and resold indefinitely. The absence of Reported Details on encryption status or additional safeguards means affected people must assume the information is usable by third parties.

If your data was in this breach

Begin by treating any unsolicited communication that references Vietnam Airlines, loyalty points or travel details with heightened caution. Change passwords on the airline’s customer portal and on any other accounts that share the same email address or password. Enable multi-factor authentication wherever it is offered, preferably using an authenticator app rather than SMS. Monitor bank and credit-card statements for unexpected charges and consider placing a fraud alert with credit-reporting agencies if you reside in a jurisdiction that provides that option. Review loyalty-account activity for unauthorised redemptions. Finally, readers can run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets; such a check provides an early indication of wider circulation and helps prioritise further protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.