Loading story…
Civil society groups have called on the UK's Information Commissioner's Office (ICO) to investigate the Home Office's digital-only eVisa scheme, citing systemic data errors and design flaws that have led to breaches of sensitive personal information and left migrants unable to prove their lawful status. The complaints highlight operational failures, such as the wrongful disclosure of personal data and the lack of effective support for users locked out of their accounts, raising concerns about the scheme's compliance with GDPR and its impact on vulnerable populations who may be digitally excluded.
Separately, the US State Department has implemented a policy requiring H-1B visa applicants and their dependents to make their social media profiles public before consular interviews, exposing them to significant privacy and security risks. This move, intended to facilitate online presence reviews for national security vetting, affects hundreds of thousands of skilled workers and their families, many of whom are employed in sensitive industries. Critics warn that this forced digital exposure increases the risk of doxxing, surveillance, and exploitation by malicious actors, while also raising broader concerns about the erosion of privacy rights for immigrants.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The US State Department introduced a policy requiring H-1B visa applicants and their dependents to set all social media profiles to public before consular interviews. The requirement is described as taking effect on December 15 and raises privacy and security concerns for more than a million affected people.
The UK Information Commissioner's Office confirmed it had received the letter about the Home Office eVisa scheme and said it would assess the concerns raised. The Home Office had not commented at the time of reporting.
Civil society groups coordinated by the Open Rights Group submitted a complaint urging the UK Information Commissioner's Office to investigate the Home Office's digital-only eVisa rollout for potential GDPR violations. The complaint alleges systemic data errors, design failures, inadequate support, sensitive data exposure, and problems with the scheme's data protection impact assessment and biometric data handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European privacy watchdogs and digital rights advocates are pushing back against the European Commission’s proposed **“Digital Omnibus”** package, arguing that amendments billed as regulatory “streamlining” could **weaken EU privacy protections** and erode fundamental rights. Reported concerns focus on proposed changes to the **GDPR**, including narrowing the definition of **personal data** so that not all data that could potentially be linked to an identifiable person would qualify, alongside other adjustments intended to reduce compliance friction (e.g., reducing cookie banner requirements in some cases and simplifying multi-law breach notification processes). Separately, UK officials told Parliament that **legacy IT** is impeding implementation of technical controls meant to prevent repeats of the Ministry of Defence’s highly sensitive Afghan data exposure, where roughly **19,000** resettlement applicants’ details were compromised via a **CC instead of BCC** email error. The government’s Information Security Review recommended shifting cross-government information sharing away from email/attachments and toward source-based sharing, but ministers and the chief data officer cited departmental system fragmentation as a barrier to rolling out attachment-blocking and safer data-transfer mechanisms at scale.
Jun 29, 2026
A third-party site called **UK Visa Portal** publicly exposed sensitive immigration application records, including passport images and selfie photos uploaded by people seeking U.K. visa-related services. Reporting said at least **100,000 documents** were accessible online, and affected records were verified as authentic. The site is **not affiliated with the U.K. government**, but some applicants reportedly used it and paid for its services instead of submitting documents through the official **`GOV.UK`** portal. Efforts to alert the company were hampered by the absence of a clear security contact or identified management, and the exposure reportedly remained unresolved. Separate reporting highlighted a similar identity-data exposure involving **AU10TIX**, an identity verification provider used by major platforms including **TikTok**, **X**, and reportedly **Uber**. Researchers found exposed credentials that allegedly allowed access to logs containing names, dates of birth, nationalities, identification numbers, document types, and uploaded images of government-issued IDs such as driver’s licenses. The incident drew renewed scrutiny to outsourced age and identity verification systems, which concentrate highly sensitive personal data and can increase the risks of identity theft, phishing, blackmail, and loss of anonymity when security controls fail.
Jun 29, 2026
UK and US government agencies are expanding digital identity programs, but with uneven adoption and growing scrutiny. In the UK, the Government Digital Service reported that just over **15,000** veterans have applied for a digital veterans ID since its October launch—under **1%** of the roughly **1.8 million** eligible former service members—highlighting slow uptake and limited utility compared with the physical Veteran Card. The digital credential is stored in the *GOV.UK One Login* app (planned to be rebranded as the *GOV.UK Wallet*), and currently has constrained use cases, including not being accepted as photo ID for domestic flights or for some veteran benefits, and not yet being usable online. In the US, Customs and Border Protection and the Transportation Security Administration are accelerating deployment of **facial biometric** identity verification for travelers, with CBP requiring biometric verification for **all non-citizens** entering or leaving the US (with US citizens able to opt out for manual checks). Officials described facial biometrics as foundational to vetting and border security operations, while lawmakers and civil society groups continue to raise privacy and civil-rights concerns; TSA’s use of facial recognition has also drawn oversight attention, including a Department of Homeland Security watchdog investigation. Together, the developments reflect a broader shift toward mobile and biometric identity systems, alongside adoption, usability, and governance challenges.
Jun 29, 2026