Breach report
Unofficial 'UK Visa Portal' site left applicants' passports and selfies exposed
AI-generated illustration by CyberShitty. Not a photograph or a document from the organisations named.
A private visa-help website not linked to the UK government stored at least 100,000 uploaded documents in an Amazon bucket anyone could read, TechCrunch found. It was locked only after publication.
What happened
UK Visa Portal, a paid visa-help website that also trades as UK Visit and ETA-Pass, stored applicants' uploaded passports and selfies in an Amazon-hosted storage bucket. An anonymous source told TechCrunch that at least 100,000 documents were reachable: the bucket did not list its contents publicly, but each file could be opened by anyone with its web address, and a back-end bug revealed the list of files. Many images also carried location data embedded in the photo.
The site is not affiliated with the UK government. TechCrunch reported it is allegedly run by Active Leadgen LLC, which says it is based in the United Arab Emirates.
Confirmed vs. claimed
Confirmed by TechCrunch's reporting: the exposed documents and the lack of access controls. The bucket was secured overnight after TechCrunch published its story, according to TechCrunch and Security Affairs.
Not confirmed: the operator has not publicly acknowledged the exposure. Lawyers and a PR firm contacted TechCrunch on its behalf but did not say how long the files were exposed, whether logs show other access, or whether applicants or regulators will be notified.
Who is affected
Anyone who uploaded a passport or selfie to this site while applying for a UK visa or electronic travel authorisation (ETA). Applicants' nationalities have not been reported.
What to do
- Apply for UK visas and ETAs only through GOV.UK; third-party sites charge extra and are not needed.
- If you used this site, watch for phishing that references your travel plans, and consider asking your passport authority whether a replacement is advisable.
- Be wary of identity checks or loans opened in your name; see what to do after a data breach notice.
- UK residents can complain to the Information Commissioner's Office if they do not get answers from the operator.
Sources
More breaches in United Kingdom
- Revolut — 12 Sep 2026