2026 UK Visa Portal — public S3 bucket exposed applicant passports and selfies (third-party site)
Data compromised
Passports, selfie photos, and location metadata from U.K. visa applicants who paid the third-party site
Technical writeup
UK Visa Portal (also marketed as UK Visit / ETA-Pass), a third-party site not affiliated with GOV.UK, left an Amazon-hosted storage bucket exposing passports and selfie verification photos of applicants who paid the service instead of using official U.K. immigration channels. A tipster reported at least 100,000 exposed documents; TechCrunch verified authenticity by contacting affected individuals. The site is allegedly operated by Active Leadgen LLC; attorneys responded after TechCrunch disclosure but had not confirmed remediation scope at catalog time.
Root cause
Public Amazon S3 bucket with directly accessible uploaded files (misconfiguration)