A website called UK Visa Portal is publicly exposing the passports and selfies of applicants who registered and paid on the site to obtain a UK immigration visa, TechCrunch has learned.
An anonymous person notified TechCrunch about the security flaw, saying that the website is exposing at least 100,000 documents from people who uploaded their passports and selfies to the website as part of the application process.
The website is not affiliated with the UK government and some have he complained who mistakenly paid a fee to this company instead of using the official GOV.UK website.
TechCrunch confirmed that UK Visa Portal is the source of the data breach and verified the authenticity of the exposed data by contacting affected individuals to ask if their information was accurate.
UK Visa Portal does not have a way to report security issues through its website, nor does its website provide names or contact information for company management. TechCrunch sent an email to the address listed on the UK Visa Portal website to alert the company that it has an ongoing security flaw and ask who in management can agree to specific details to resolve the issue. Given the sensitivity of the exposed data, TechCrunch explained that it could not share details with the company’s general customer support inbox because it could not guarantee that the exposed data would not be misused.
Instead, TechCrunch received a response from the company’s supposed lawyers and public relations firm. TechCrunch again explained that, given the nature of the exposed files, it could only share details directly with the company’s management and asked that TechCrunch be contacted.
TechCrunch has not received a response from UK Visa Portal management. The security flaw has not yet been fixed.
While the security issue continues, TechCrunch believes it is in the public interest for people who use the company’s services to be aware of the issue. TechCrunch does not publish precise details in an effort to minimize any additional risk to your information.
There is no need to use a third-party service to apply for an electronic travel authorization to the United Kingdom, unless you hire an immigration lawyer, and applicants must apply via the UK government website.
When you buy through links in our articles, we may earn a small commission. This does not affect our editorial independence.
