Loading story…
A third-party site called UK Visa Portal publicly exposed sensitive immigration application records, including passport images and selfie photos uploaded by people seeking U.K. visa-related services. Reporting said at least 100,000 documents were accessible online, and affected records were verified as authentic. The site is not affiliated with the U.K. government, but some applicants reportedly used it and paid for its services instead of submitting documents through the official GOV.UK portal. Efforts to alert the company were hampered by the absence of a clear security contact or identified management, and the exposure reportedly remained unresolved.
Separate reporting highlighted a similar identity-data exposure involving AU10TIX, an identity verification provider used by major platforms including TikTok, X, and reportedly Uber. Researchers found exposed credentials that allegedly allowed access to logs containing names, dates of birth, nationalities, identification numbers, document types, and uploaded images of government-issued IDs such as driver’s licenses. The incident drew renewed scrutiny to outsourced age and identity verification systems, which concentrate highly sensitive personal data and can increase the risks of identity theft, phishing, blackmail, and loss of anonymity when security controls fail.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
TechCrunch reported that the UK Visa Portal exposure was secured hours after its initial story was published. The company did not directly explain the remediation and continued routing communications through attorneys and a public relations firm.
As of the reporting, the UK Visa Portal data exposure had not been fixed and sensitive applicant documents were still publicly accessible. Coverage noted the site was not affiliated with the U.K. government and reiterated advice for applicants to use the official GOV.UK service instead.
After identifying the exposure, TechCrunch tried to notify UK Visa Portal, but said the site lacked a clear security reporting channel and did not identify its management. The publication reported receiving replies from purported attorneys and a public relations firm rather than company leadership.
TechCrunch verified that UK Visa Portal was publicly exposing sensitive applicant documents, including passport images and selfie photos submitted for U.K. visa-related services. An anonymous source told the publication that at least 100,000 documents were exposed, and TechCrunch confirmed the authenticity of the leaked records by contacting affected individuals.
A researcher used the exposed AU10TIX credentials to access the company's logging platform and found links to highly sensitive identity records, including uploaded government IDs. Reporting said the researcher demonstrated access to data associated with identity checks for major online platforms and services.
A reported security exposure left AU10TIX login credentials publicly accessible for more than a year, enabling access to the company's logging platform and sensitive identity verification records. The exposed data reportedly included names, dates of birth, nationalities, identification numbers, document types, and uploaded ID images tied to services used by platforms such as TikTok and X.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcetechcrunch.com
Open sourcereddit.com
Open sourcedarkreading.com
Open sourceeff.org
Open source404media.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Civil society groups have called on the UK's Information Commissioner's Office (ICO) to investigate the Home Office's digital-only eVisa scheme, citing systemic data errors and design flaws that have led to breaches of sensitive personal information and left migrants unable to prove their lawful status. The complaints highlight operational failures, such as the wrongful disclosure of personal data and the lack of effective support for users locked out of their accounts, raising concerns about the scheme's compliance with GDPR and its impact on vulnerable populations who may be digitally excluded. Separately, the US State Department has implemented a policy requiring H-1B visa applicants and their dependents to make their social media profiles public before consular interviews, exposing them to significant privacy and security risks. This move, intended to facilitate online presence reviews for national security vetting, affects hundreds of thousands of skilled workers and their families, many of whom are employed in sensitive industries. Critics warn that this forced digital exposure increases the risk of doxxing, surveillance, and exploitation by malicious actors, while also raising broader concerns about the erosion of privacy rights for immigrants.
Jun 29, 2026
Google updated *Google Voice* onboarding so **new users must complete identity verification with government-issued ID** (e.g., passport, national ID, driver’s license) before a newly assigned number can be used for calling or two-way messaging. The change is positioned as an anti-abuse control to reduce “gray market” acquisition and criminal misuse of Voice numbers for spam and other malicious activity, with automated checks, possible manual review, and limits on repeated verification attempts that can result in a number being barred from verification. In Australia, a reported case involving a Victorian teacher highlights how **government ID data (passport number) can be leveraged for account takeover**, including an apparent phone-number transfer (consistent with a SIM-swap/number-port style event) that enabled interception of 2FA codes and subsequent access to bank and superannuation accounts. The incident is discussed in the context of rental application platforms and broader concerns about **over-collection and exposure of sensitive identity documents**, with reporting citing analysis that millions of leasing documents across multiple services may be accessible online without authentication—raising the likelihood of ID data theft that can be reused to defeat identity checks and facilitate financial fraud.
Jun 29, 2026
Organizers of **Abu Dhabi Finance Week (ADFW)** inadvertently exposed sensitive identity documents for roughly **700 attendees** after an associated **cloud storage server was left publicly accessible**. Reporting indicated the exposed files included **passport scans, national ID cards, and other personally identifiable information**, affecting high-profile individuals such as former UK Prime Minister **David Cameron** and other global finance and government figures. An independent security researcher reportedly discovered the dataset using common cloud-scanning tools, and the data may have been accessible for **at least two months** before being addressed. The incident underscores ongoing risk from **misconfigured or unsecured cloud storage** supporting major events and third-party registration workflows, where large volumes of identity documents are collected and retained. Other items in the provided set cover unrelated topics (post-quantum planning, phishing kits, supply-chain malware on Android devices, and general security roundups/advice) and do not add material facts about the ADFW exposure.
Jul 12, 2026