A travel authorisation middleman has been accused of exposing thousands of documents after an alleged data leak. Travellers to the UK are now required to obtain the new electronic travel authorisation (ETA) before their journey, and countless websites have emerged to facilitate the service.
UK Visa Portal Under Scrutiny
One such website is UK Visa Portal, an independent travel assistance company that reviews travellers’ applications and submits them to the Home Office on their behalf for a fee. It is not linked to the UK government. The official ETA through the gov.uk website costs £20, while other services typically charge extra.
Now accusations have been levelled against the UK Visa Portal, claiming it exposed at least 100,000 documents, including customers’ passport images and selfies. First reported by TechCrunch, an anonymous source alleged that the security glitch made the documents viewable through the back-end. The exposure was secured overnight into Wednesday, the outlet reported.
Technical Flaw Exposed Sensitive Data
The issue allegedly stemmed from a public storage server known in the tech world as a bucket. UK Visa Portal uses it for storing the passports and selfies uploaded by users. A source claimed that a bug had made the list of files housed in the bucket viewable from the UK Visa Portal website back end.
Many of the files are said to have contained live location data, which could expose a user’s home address. The source of the data leak allegedly led to UK Visa Portal, TechCrunch reported. It said it authenticated exposed data by contacting affected people. Metro has approached UK Visa Portal for a comment.
What is ETA?
Electronic travel authorisation (ETA) permits travel to the UK, generally for tourism and visiting family. The requirement started on February 25, 2026, as part of broader digital border changes. It costs £20 from the government website, but third parties might charge more.
For example, tourists from EU countries and the US need to apply for the ETA, while UK citizens and those with an indefinite leave to remain, such as a settled status, do not need it to travel to Britain. Dual British citizens do not need an ETA, but under the new rules, they must use a British passport to travel into the UK. Many dual citizens who had not previously needed a British passport reported being caught out when the changes were brought in earlier in the year.
Have you been affected? Please email noora.mykkanen@metro.co.uk. Get in touch with our news team by emailing us at webnews@metro.co.uk.
