UK Visa Portal breach leaks 100,000+ passport scans

A significant data breach has exposed the sensitive personal documents of thousands of individuals who used a third-party visa application website. The website, operating under the name UK Visa Portal, left more than 100,000 passport scans and verification selfies publicly accessible online due to an unsecured cloud storage system. The site is not affiliated with the UK government.

The exposed data includes primary passport pages revealing full names, passport numbers, nationalities, dates and places of birth, and issue and expiry dates. In some cases, accompanying documents also exposed home addresses, contact numbers, and email addresses. The security lapse reportedly stemmed from a misconfigured cloud storage repository that lacked password protection, allowing anyone with a direct link to access the files. The vulnerability remained unaddressed for a significant period after its discovery.

Cybersecurity experts warn that the exposure of such immutable identity documents creates serious risks for fraud and identity theft. Unlike passwords, passport details cannot be easily changed, and the leaked biometric selfies could be used for impersonation. Individuals who may have used...