A travel authorisation middleman has been accused of exposing thousands of documents after an alleged data leak.
Travellers to the UK now have to obtain the new electronic travel authorisation (ETA) before their journey, and countless websites have popped up to facilitate the service.
One of them is UK Visa Portal, an independent travel assistance company reviewing travellers’ applications and submitting them to the Home Office on their behalf for a fee.
It is not linked to the UK government. The official ETA through the gov.uk website costs £20, while other services usually charge extra.
Now accusations have been levelled against the UK Visa Portal, claiming it exposed at least 100,000 documents, including customers’ passport images and selfies.
Sign up for all of the latest stories
Start your day informed with Metro’s News Updates newsletter or get Breaking News alerts the moment it happens.
First reported by TechCrunch, an anonymous source alleged that the security glitch made the documents viewable through the back-end.
The exposure was secured overnight into Wednesday, the outlet reported.
The issue allegedly stemmed from a public storage server known in the tech world as a bucket. UK Visa Portal uses it for storing the passports and selfies uploaded by users.
A source claimed that a bug had made the list of files housed in the bucket viewable from the UK Visa Portal website back end.
Many of the files are said to have contained live location data, which could expose a user’s home address.
The source of the data leak allegedly led to UK Visa Portal, TechCrunch reported. It said it authenticated exposed data by contacting affected people.
Metro has approached UK Visa Portal for a comment.
What is ETA?
Electronic travel authorisation (ETA) permits travel to the UK, generally for tourism and visiting family.
The requirement started on February 25, 2026, as part of broader digital border changes.
It costs £20 from the government website, but third parties might charge more.
For example, tourists from EU countries and the US need to apply for the ETA, while UK citizens and those with an indefinite leave to remain, such as a settled status, do not need it to travel to Britain.
Dual British citizens do not need an ETA, but under the new rules, they must use a British passport to travel into the UK.
Many dual citizens who had not previously needed a British passport reported being caught out when the changes were brought in earlier in the year.
Have you been affected? Please email noora.mykkanen@usnewsrank.com
Get in touch with our news team by emailing us at webnews@usnewsrank.com.
For more stories like this, check our news page.
Discover more from USNewsRank
Subscribe to get the latest posts sent to your email.