A UK visa portal has leaked thousands of applicants’ passports and personal photos online – and has not fixed the leak

TechCrunch has learned that a website called the UK Visa Portal publicly discloses the passports and personal photos of applicants who have registered and paid for the site for a UK immigrant visa.

An anonymous person reported the vulnerability to TechCrunch, saying the site was exposing at least 100,000 documents from people who uploaded their passports and personal photos to the site as part of the application process.

The site is not affiliated with the UK government, and some have complained that they mistakenly paid fees to this company instead of using the official GOV.UK site.

TechCrunch confirmed that the UK Visa Portal was the source of the data leak and verified the validity of the exposed data by contacting affected individuals to ask if their information was accurate.

UK Visa Portal does not have a way to report security issues through its website, and its website does not provide names or contact information for company management. TechCrunch sent an email to the address listed on the UK Visa Portal website to alert the company that it has an ongoing security vulnerability and to ask who in management could accept specific details to resolve the issue. Due to the sensitivity of the exposed data, TechCrunch explained that it could not share details with the company’s general customer support inbox because it could not guarantee that the exposed data would not be misused.

Instead, TechCrunch received a response from the company’s alleged lawyers and PR firm. TechCrunch again clarified that due to the nature of the exposed files, it could only share details directly with company management, and asked them to put TechCrunch in touch with them.

TechCrunch has not received any response from the UK Visa Portal administration. The vulnerability has not been fixed yet.

While the security issue persists, TechCrunch believes it is in the public interest for people using the company’s services to be aware of the issue. TechCrunch does not publish exact details in an attempt to minimize any additional risks to their information.

It is not necessary to use a third party service to apply for a UK eTA, unless you retain an immigration lawyer, and applicants must apply through the UK government website.