Vietnam Airlines data breach: what happened and what to do

What happened

In June 2025, attackers got into the Salesforce environment that Vietnam Airlines uses to manage customer records. The airline was one of several companies hit by the same campaign, in which a group calling itself "Scattered LAPSUS$ Hunters" reportedly tricked staff into giving access to their Salesforce accounts. After Salesforce refused to pay a ransom, the group published stolen data from several organizations in October 2025, including Vietnam Airlines and Qantas.

Have I Been Pwned (HIBP) added the Vietnam Airlines data on October 11, 2025, and counts 7,316,915 unique email addresses. Asia Times reported that the airline stayed quiet for more than two days after the leak and then confirmed the incident in an email to customers on October 14. Some outlets floated higher numbers, up to 23 million accounts, but the figure verified by HIBP is 7.3 million.

What was exposed

HIBP lists these types of data: email addresses, names, phone numbers, dates of birth and loyalty program details (membership numbers). It does not list passwords, passport numbers or payment card details for this breach.

What that lets criminals do

Travel data makes good phishing material. A message that uses your real name, your frequent flyer number and a flight-related excuse ("your booking was cancelled, confirm here") looks much more convincing than a generic scam. Expect fake refund emails, fake loyalty point offers and calls or texts that claim to be from the airline.

Dates of birth are the more lasting problem. Your name, email, phone number and date of birth together are the standard starting kit for identity checks at banks and phone carriers, and unlike a password you can't change a birthday.

Loyalty accounts can also be targeted directly. Points have a cash value, and criminals who know your membership number may try to reset your login and drain them.

What Vietnam Airlines has said

The airline confirmed the incident to customers by email in October 2025. If you flew with Vietnam Airlines or joined its Lotus Miles loyalty program, read the notice on the airline's own website rather than following links in messages, since scammers imitate breach notices.

Was your data included

Check your email address on Have I Been Pwned. A free Serus scan also checks your email and phone number against this and other breaches. Serus can't remove breach data, but it monitors for new exposures and alerts you when they appear.

How to read the numbers

The 7.3 million figure counts unique email addresses, not trips or bookings. One person with two email addresses can appear twice, and a family booking under one address appears once. Press coverage gave other totals, so use the HIBP count if you need a single number. If your email is not in the list, your details may still have been in the airline's records, because a leak only publishes part of what attackers hold.

The same campaign hit other companies, so if you also flew with Qantas or shop at one of the other named brands, check those notices as well.