Vietnam Airlines National Carrier Breach (Salesforce, 2025): 7.3 Million Passenger Records Including Loyalty Program Data Exposed

About Vietnam Airlines

Vietnam Airlines is the flag carrier of Vietnam, operating domestic and international flights and a frequent-flyer loyalty program.

Why They Hold Your Data

Airlines collect passenger identity, contact details, booking records, payment-adjacent information, itinerary data, loyalty accounts, and customer-service interactions across travel operations.

Recent Developments

In October 2025, Scattered Lapsus$ Hunters published a Vietnam Airlines dataset they said was taken from the airline’s Salesforce environment earlier in the year, part of a broader campaign against Salesforce customers.

Data Points Exposed

Breach Impact

The identity and loyalty data supports targeted phishing and account-takeover attempts against travelers, and inclusion in the wider Salesforce campaign means the same actor holds comparable data on many other brands.

Exploitation & Downstream Threats

• Identity verification bypass using name + date of birth combination | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses

What You Should Do

1. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
2. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).