The Vietnam Airlines breach via a SaaS partner: a supply-chain lesson

This analysis draws on Vietnam Airlines' official statement together with public news reports and cybersecurity analyses. Figures and platform names reported by the press are clearly attributed; the goal is to draw shared lessons, not to judge any single company.

On 14 October 2025, Vietnam Airlines confirmed a customer data breach. The notable part: it was not the airline's own systems that were attacked, but a third-party platform. This is an almost textbook example of digital supply-chain risk — something every organization running software-as-a-service (SaaS) is exposed to.

What Vietnam Airlines said (official source)

Per Vietnam Airlines' statement, data was breached through a third-party customer-service platform run by a global technology partner; the airline was among several affected companies; some data "may have been accessed without authorization".

• Data potentially exposed: full name, email address, phone number, date of birth, Lotusmiles membership number.
• Data confirmed still secure: payment-card information, passwords, travel itineraries, passport details, account balances.
• The airline's internal IT systems were not affected.

One important detail: the official statement deliberately named no specific platform and gave no figure. That is prudent, appropriate conduct while an investigation is still open.

What the press reported (third-party information)

What the statement did not say, the press filled in. Read this section as third-party information not officially confirmed by Vietnam Airlines:

• A dataset said to belong to over 7.3 million Vietnam Airlines customers circulated on forums and underground data markets. VietTimes notes some sources put the number as high as 23 million — so even the figure itself is unsettled.
• The data was reportedly extracted from Salesforce, the global customer relationship management (CRM) platform — per Bloomberg, cited by VietTimes. In other words, the attacker targeted Salesforce's systems, not Vietnam Airlines' systems.
• The group named is Scattered LAPSUS$ Hunters (a new name for ShinyHunters) — the same group linked to the September 2025 breach of Vietnam's National Credit Information Center (CIC). Around 39 companies were affected, including Google, Cisco, Disney and FedEx. The attacker demanded a ransom from Salesforce, was refused, then leaked the data.

What actually happened: third-party OAuth tokens

A technical analysis by Google Threat Intelligence (GTIG) and Mandiant describes a widespread data-theft campaign (tracked as UNC6395): attackers stole OAuth tokens tied to the Salesloft Drift app — a third-party integration plugged into Salesforce — then used those tokens to pull data from hundreds of companies' Salesforce instances. GTIG said over 700 organizations were potentially affected. Salesloft issued an advisory on 20 August 2025 and revoked the Drift–Salesforce connection; Salesforce also published an official advisory and publicly refused to pay the extortion.

The crux: no one attacked Vietnam Airlines directly. The data left the airline's control because it lived on a third-party platform — and a secondary integration (a chatbot/marketing tool) of that very third party had its tokens stolen.

Why this is a supply-chain risk

When an organization uses SaaS — CRM, chatbot, email marketing, analytics — customer data flows into systems beyond its direct control. Each OAuth integration is a key handed to a third party: a leaked token means the door opens without a password, without breaching your firewall.

This is exactly the risk that OWASP Top 10:2025 just added as category A03 Software Supply Chain Failures. The Vietnam Airlines incident is a vivid illustration: the weak link was not the airline, but a supplier two layers away.

Lessons for Vietnamese businesses

You cannot "patch" this risk with a single product. It demands governance discipline:

1. Inventory third parties and integrations. Know which SaaS platforms hold your customer data, and which OAuth integrations are open on each.
2. Minimize the data you share. Push only the fields a function truly needs; don't sync full customer records just for convenience.
3. Govern tokens and permissions. Review OAuth tokens periodically, revoke unused integrations, keep scopes minimal.
4. Monitor for abnormal access. Unusually large data exports over a CRM's API should raise an alert — that was the key signal in this campaign.
5. Have a response and notification plan ready. Vietnam Airlines reacted fast, coordinated with authorities, and notified customers — in line with the PDPL's breach-notification duty. That process must exist before an incident, not be built mid-crisis.
6. Consider keeping sensitive data within your control. The more sensitive the data, the more you should limit pushing it to third-party platforms; favor self-hosted systems where you control access, logs and encryption.

Conclusion

The Vietnam Airlines case is not a story of "an airline getting security wrong". It is a reminder that the digital supply chain is longer than we think: your security is only as strong as the weakest link among your suppliers. For customer data, the question is no longer "is my system secure" but "is everywhere my data travels secure".

If you want to review third-party risk and strengthen API and data protection for your organization, book a consultation to assess against your actual systems.