Active Leadgen

Disclosed May 27, 2026295 affectedConfirmed

Unofficial UK visa portal exposed 100,000 passport and selfie files

A private UK visa application site run by Active Leadgen, not affiliated with the UK government, exposed at least 100,000 applicants' passports, selfies and location metadata through an enumerable Amazon S3 bucket. The bucket was secured after TechCrunch published.

What is known

People affected	295 (as reported by the organization)
Disclosed	May 27, 2026
Happened	May 23, 2026
Attack	Exposed data
Data exposed	Government IDsBiometricsLocation
Sector	Other · AE
Status	Confirmed

Sources

Newstechcrunch.com

UK visa portal spilled thousands of applicants' passports and selfies online

Official noticein.gov

Indiana Attorney General 2026 data breach report: Active Leadgen

Notices filed

TotalMay 27

ResearchCount not stated

Residents of INJun 25

Indiana AG2 people

History of this record

source_type2026-09-25

press to officialby backfillSource

source_url2026-09-25

https://techcrunch.com/2026/05/27/uk-visa-portal-spilled-thousands-of-applicants-passports-and-selfies-online-and-hasnt-fixed-the-leak/ to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-7_2026.pdfby backfillSource

status2026-09-25

disclosed to confirmedby backfillSource

verified_by2026-09-25

empty to in-agby backfillSource

verified2026-09-25

0 to 1by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 295by backfillSource

occurred2026-09-25

empty to 2026-05-23by backfillSource

Added2026-09-25

First recordedby seedSource

First seen 2026-09-25 (Research), confirmed by Indiana AG. Record counts are as reported. Not legal advice.

Everything about Active Leadgen