OneFly Exposes Thousands of Sensitive Customer Records via Unsecured Elasticsearch Instance Security researchers at Cybernews uncovered a significant data leak at OneFly, a global travel technology and flight content aggregator, exposing thousands of sensitive customer records through an unsecured Elasticsearch instance. The breach, detected in early October 2025, involved real-time exposure of data from nine internal Java Spring Applications, though the exact duration and total number of affected individuals remain unclear. The leaked records included names, dates of birth, ID document details, flight information (numbers, prices, dates, destinations), full credit card details, and JWT tokens. Researchers identified approximately 10,000 ID records and 6,000 payment cards, describing the figure as a "rather minimal" estimate. OneFly, which employs between 50 and 200 people, serves over 100 airlines and major online travel agencies (OTAs) worldwide, providing unified APIs for ticket inventories and pricing. The exposed data poses severe risks, including fraudulent transactions, identity theft, and phishing attacks targeting customers under the guise of airlines or travel agencies. Additionally, compromised JWT tokens could enable attackers to impersonate users and access internal systems. Cybernews noted that the breach highlights the need for access control rules, refined logging processes, and IP whitelisting to prevent similar incidents. The company has not disclosed whether affected customers were notified.