Visa data leak piles pressure on Britain’s digital ID push
The leak of more than 100,000 passport scans and biometric selfies linked to a third-party visa website has renewed concerns over the security risks surrounding Britain’s growing shift towards digital ID systems.
A site operating under the name UK Visa Portal – which is not affiliated with the UK government – was found on Wednesday to have left highly sensitive identity documents publicly accessible after users uploaded passports and verification selfies as part of visa applications.
The breach, first reported by TechCrunch, exposed passport images, selfies and location data through an unsecured cloud storage system. Some data went as far as revealing users’ home addresses.
The leak comes as ministers continue to work on a broader digital ID rollout that would eventually underpin everything from right-to-work checks to access to public services.
Last year, Sir Keir Starmer’s government unveiled plans for a smartphone-based digital ID system designed to store credentials including names, nationality, residency status and biometric verification details.
Ministers argued the scheme could streamline bureaucracy and modernise interactions with the state, comparing the system to online banking or contactless payments.
But the proposals quickly triggered backlash over privacy and cybersecurity concerns, forcing the government to soften plans for mandatory checks after public opposition mounted.
A crisis of trust for digital ID?
Cybersecurity experts warned that exposed ID documents create serious risks for fraud and impersonation, particularly as digital verification systems become more widely used across financial services and online platforms.
This week’s visa portal fiasco appears to have stemmed from an Amazon-hosted cloud storage bucket that allowed uploaded files to remain accessible to anyone with the correct web address.
According to reports, the website had no clear route for reporting security flaws and failed to respond directly when journalists attempted to alert management to the exposure.
The company is alleged to be operated by a UAE-based business called Active Leadgen LLC, although reports said this could not be independently verified.
The government has repeatedly stressed that official UK visa and electronic travel authorisation applications can be completed directly through GOV.UK without using third-party intermediary websites.
The leak also comes as ministers face mounting scrutiny over the wider digital ID project itself.
Just this week, the Home Affairs Committee criticised the government’s handling of the policy, describing the original rollout as “rushed, poorly thought through and failed to make a convincing case”.
MPs warned public trust would be essential if digital identity systems are to gain widespread adoption, particularly given the government’s “poor track record” on large-scale digitisation projects.
Industry groups have similarly cautioned that badly designed digital identity systems risk concentrating too much sensitive personal information in one place.
The Open Data Institute recently warned that digital ID schemes must avoid creating “new concentrations of power” for either governments or large technology companies, arguing that privacy and security needed to be “non-negotiable”.
At the same time, businesses continue pushing for faster adoption of digital verification systems as employers and online platforms seek simpler ways to verify identities remotely.
The government still plans to roll out digital ID services more broadly by the end of the decade, although ministers now insist participation will remain voluntary.