Global Data Exploitation in Visa Processing and Humanitarian Aid Exposes Systemic Vulnerabilities A series of recent investigations has uncovered alarming patterns of data mismanagement and exploitation within global visa processing and humanitarian aid systems, disproportionately affecting vulnerable populations. Over the past two weeks, three separate reports revealed critical failures in how sensitive personal data is handled by outsourced entities, with far-reaching consequences. Visa Outsourcing: A Lucrative but Risky Empire Lighthouse Reports exposed VFS Global, a company that dominates visa processing for applicants from countries with weaker passports. The investigation found that VFS coercively upsells paid services while mishandling biometric and personal data, operating with minimal accountability. Meanwhile, an unsecured website, UK Visa Portal, leaked over 100,000 passport scans, ensnaring applicants who believed they were using an official channel. These breaches highlight the risks of outsourcing public functions to private entities with little oversight, where consent is often illusory and security lapses are common. Humanitarian Aid Under Cyber Threat The World Food Programme (WFP) suffered a major cyberattack compromising the personal data of 600,000 households in Gaza the largest known breach of humanitarian beneficiary data. Names, phone numbers, and location details were exposed, leaving families vulnerable to surveillance or targeting. The incident underscores how humanitarian organizations, despite their critical role, rely on centralized digital systems that are increasingly targeted by cyber threats. Structural Power Imbalances Drive Risk These cases reveal a systemic issue: digital infrastructures for visas, refugee registration, and aid distribution centralize sensitive data in the hands of non-state actors, often with weak accountability. Applicants from the Global South, refugees, and aid recipients face coercive data collection handing over biometrics, financial records, and location data with no real alternative. Meanwhile, responsibility is fragmented: states and international organizations delegate security decisions to contractors with conflicting incentives, while legal frameworks like GDPR offer limited protection. AI and Data Colonialism Deepen the Problem The risks are compounded by the growing use of AI in these systems. VFS promotes "AI-driven document recognition and predictive analytics" to streamline visa processing, while humanitarian agencies explore analytics built on datasets encoding the vulnerabilities of displaced populations. This creates a cycle where data is extracted under duress, stored insecurely, and repurposed to assess the same marginalized groups reinforcing global inequalities. A Blueprint for Systemic Control The incidents in Bengaluru, Gaza, and the UK are not isolated failures but part of a broader architecture governing identity, mobility, and welfare. Whether for visa applicants or aid recipients, the system prioritizes efficiency and control over security and consent. As long as power remains concentrated in the hands of states and contractors with little input from those most affected technical fixes will only address symptoms, not the underlying imbalances.