A third-party website processing UK visa applications exposed thousands of applicants' passports and selfies online. The company has not fixed the breach and instead sent legal threats to researchers who discovered it.
A security vulnerability in a third-party platform handling UK visa applications left sensitive personal documents publicly accessible online for an unknown period.
The exposed data included passport scans, selfies, and other identity verification documents submitted by visa applicants. The breach affected thousands of individuals applying through the portal.
Security researchers identified the leak and attempted to report it through standard disclosure channels. Rather than addressing the technical vulnerability, the company responded by sending cease-and-desist letters to the researchers.
The portal remains operational with the vulnerability unfixed. There is no public timeline for remediation or notification of affected applicants.
The incident raises concerns about the security practices of third-party vendors processing sensitive government applications. UK visa applicants have no control over which contractors handle their biometric and identity data.
This breach adds to a growing pattern of security failures in government digital services. Previous incidents have exposed similar categories of personal information through inadequately secured systems.
Affected applicants currently have limited visibility into whether their data was accessed or how it was used. No official statement has been released detailing the scope of the exposure or remediation efforts.
The company's decision to pursue legal action against security researchers rather than fix the vulnerability represents a significant breach of responsible disclosure practices. Industry standards expect companies to prioritize fixing security issues and protecting users over intimidating researchers.
The FBI is investigating a newly launched dark web service called Nexus that claims to possess digital scans of over 153 million driver's licenses from US and Canadian residents. The service is actively selling the stolen identification data.
International law enforcement agencies and private sector partners have seized infrastructure belonging to the Sality malware botnet, a peer-to-peer network used for unauthorized computer access and data theft.
SonicWall has warned customers of two new zero-day vulnerabilities in its SMA1000 appliances being chained together in active remote code execution attacks.
A newly launched dark web marketplace is selling digital scans of over 153 million driver's licenses from U.S. and Canadian residents. The FBI's New Orleans field office has opened an investigation into the breach, which appears to originate from a Louisiana-based identity verification company.