Vietnam Airlines Data Breach (2025)

On June 20, 2025, Vietnam Airlines suffered a breach of its Salesforce environment that exposed the personal details of 7.3 million customers. The stolen records, which included names, email addresses, phone numbers, dates of birth, and loyalty program membership numbers, were later released publicly in October 2025 by a group calling itself Scattered LAPSUS$ Hunters.

What Public Reporting Shows

Public reporting indicates the intrusion targeted the airline’s Salesforce instances. The dataset contained 7.3 million unique customer email addresses along with associated names, phone numbers, dates of birth, and loyalty program details. The breach occurred in June 2025, with the data appearing on leak sites four months later. Industry research from sources such as DoxxScan™ continuous monitoring confirms the exposure and lists the precise fields involved. No evidence has surfaced that payment card data or government-issued ID numbers were taken.

Why This Matters for You and Your Family

When an airline loyalty account is breached, the information rarely stays isolated. Names, dates of birth, and phone numbers are the exact building blocks fraudsters use to impersonate you with banks, government agencies, or other travel providers. For families, a single exposed parent record can lead to children’s accounts being targeted through shared email addresses or family booking references. Once criminals have your phone number and date of birth, they can reset passwords on linked services, turning one breach into months of potential identity headaches.

The Doxxing and Identity-Chain Implications

The combination of email, phone, full name, and date of birth creates a powerful starting point for doxxing chains. Attackers can correlate the leaked loyalty number with public flight records or social-media posts to map travel patterns, home addresses, and family relationships. Credential leaks like this one frequently cascade into gaming account takeovers when children use the same email address for both airline bookings and online games. What begins as a travel reward breach can quietly expose an entire household’s digital footprint across platforms.

Scattered LAPSUS$ Hunters Track Record

Public reporting attributes the October 2025 release to a group named Scattered LAPSUS$ Hunters. The group emerged in 2024 and has focused on Salesforce instances belonging to airlines, retailers, and other large organizations. Notable prior victims include several international companies whose customer databases appeared on the same leak sites. Their typical playbook involves initial access through compromised credentials or misconfigured cloud environments, followed by bulk exfiltration of customer relationship management data, and eventual public release when extortion demands are ignored.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate the password used at Vietnam Airlines anywhere it is reused and enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same contact details.
• Let remediation specialists perform hands-on takedown requests across data brokers and suspicious sites on your behalf.

The incident shows how quickly a single corporate breach can ripple into long-term personal risk. Staying ahead requires more than checking one site; it demands ongoing visibility and expert help when problems appear. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that links online handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. One short action today can prevent weeks of fallout tomorrow.