A Fake UK Visa Site Left 100,000 Passports Wide Open. Then Sent Lawyers Instead of a Fix.

A Fake UK Visa Site Left 100,000 Passports Wide Open

Pierluigi Paganini
May 28, 2026

A third-party UK visa site exposed passports and selfies on a public AWS server. It’s not official GOV.UK and affected at least 100,000 documents.

UK Visa Portal is not run by the British government. It’s a third-party service, apparently operated by a UAE-registered company called Active Leadgen LLC, that charges fees to help people apply for UK electronic travel authorizations. You don’t need it. The actual application takes minutes on GOV.UK and costs nothing extra. Thousands of people used it anyway, and now their passports and selfies have been sitting exposed on a public Amazon storage server.

TechCrunch learned about the leak from an anonymous tipster who said the site was exposing at least 100,000 documents.

“While the bucket was not publicly listing its contents, the files within were still accessible and viewable to anyone who knew the web address of each file.” reads the report published by TechCrunch.”The person who notified us about the exposure said a bug on the UK Visa Portal website’s back end allowed them to view the list of files contained in the bucket.”

TechCrunch confirmed the exposure and verified it was real by contacting affected individuals directly.

The data wasn’t just passport scans. Many of the uploaded selfies also carried embedded GPS coordinates, accurate enough in some cases to identify the photographer’s home address. That’s a passport number, a face, and a home address in a single file. Identity thieves don’t need more than that.

Passport exposure is especially concerning as governments increasingly use online identity checks and age verification laws.

TechCrunch emailed the UK Visa Portal’s support address, explaining there was an active security lapse and asking for a manager to contact them with details. The company’s customer…

Source