A TechCrunch investigation has found that a website called the UK Visa Portal is publishing the passports and selfies of applicants who have registered and paid a fee to obtain a UK immigrant visa.
An anonymous person alerted TechCrunch to the security lapse, saying at least 100,000 documents of people who uploaded their passports or selfies to the website as part of the application process were publicly available on the website.
This website is not affiliated with the UK government and we have received complaints that people have mistakenly paid fees to this company without using the official GOV.UK website.
TechCrunch confirmed that the UK Visa Portal was the source of the data breach and verified the authenticity of the leaked data by contacting affected individuals and asking if the information was accurate.
The UK Visa Portal does not have a way to report security issues through its website, and the website does not list the names or contact information for its management team. TechCrunch sent an email to the address listed on the UK Visa Portal website, alerting the company to the continuing security flaw and asking who in management could accept specific details for resolving the issue. TechCrunch explained that due to the sensitive nature of the leaked data, details cannot be shared with the company's general customer support inbox as it cannot guarantee that the leaked data will not be misused.
Instead, TechCrunch heard a response from a public relations firm that is said to be the company's attorney. TechCrunch reiterated that given the nature of the leaked files, details can only be shared directly with company management and asked TechCrunch to contact them.
TechCrunch has not yet received a response from UK Visa Portal management. The security flaw has not yet been fixed.
While the security issues persist, TechCrunch believes it is in the public interest for people using the company's services to be aware of the issues. TechCrunch is not publishing exact details to minimize further risk to the information.
There is no need to use a third-party service to apply for a UK electronic travel authorization unless you hire an immigration lawyer. Applicants must apply via the UK Government website.
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.