OneFly exposed thousands of travel records including credit cards, ID documents, and flight details through an unsecured Elasticsearch instance discovered in October 2025.