UK Visa Portal Exposes Thousands of Passport and Selfie Photos in Security Lapse A third-party website, UK Visa Portal, inadvertently exposed thousands of passports and selfie photos belonging to individuals applying for U.K. immigration visas. The breach, discovered by an anonymous source and reported by TechCrunch, involved at least 100,000 sensitive documents uploaded by applicants as part of their visa process. The exposed data was stored in an unsecured Amazon-hosted storage bucket, accessible to anyone with the direct file URLs. While the bucket did not publicly list its contents, a backend bug on the UK Visa Portal website allowed unauthorized access to the file directory. Many of the uploaded images also contained precise geolocation data, potentially revealing applicants’ home addresses. The breach was secured overnight on May 25–26, hours after TechCrunch published its initial report. However, the company allegedly operated by Active Leadgen LLC, a firm claiming ties to the UAE failed to respond directly to the security alert. Instead, its legal team (BakerHostetler) and PR firm (FTI Consulting) contacted TechCrunch, though they provided no verification of their authority to act on the company’s behalf. TechCrunch verified the authenticity of the exposed data by contacting affected individuals, confirming the leak’s legitimacy. The incident highlights a growing trend of misconfigured cloud storage leading to the exposure of government-issued identity documents, particularly as digital identity checks expand globally. Notably, UK Visa Portal is not affiliated with the U.K. government, and applicants are advised to use the official GOV.UK website for visa applications unless working with an immigration attorney. The company’s lack of transparency raises concerns about whether it will notify affected individuals or regulators, as required under U.S. state and European data breach laws. As of publication, UK Visa Portal’s management has not responded to inquiries about the duration of the exposure, the cause of the misconfiguration, or whether logs exist to determine if unauthorized parties accessed the data. The incident underscores the risks of entrusting sensitive documents to unverified third-party services.