The Somalia eTAS data breach, discovered on 11 November 2025, exposed the personal data of over 35,000 visa applicants, including full names, passport scans, home addresses, and email contacts. UK travellers who used the eTAS system should take immediate protective steps.
Unidentified hackers accessed the Somali government’s e-visa platform, with the breach declared ongoing as of September 2026. This guide explains what data was exposed, how the Immigration and Citizenship Agency responded, and what concrete actions UK applicants can take to protect themselves against identity theft, phishing campaigns, and other cybersecurity threats. The figure of 35,000 affected records was reported by BBC and Al Jazeera in November 2025.
What Happened in the Somalia eTAS Data Breach?
The Somalia eTAS data breach was discovered on 11 November 2025, compromising over 35,000 applicants’ records through access by unidentified hackers. The breach was described as the most significant cybersecurity breach in Somalia’s history, and its status remained ongoing as of September 2026. As of September 2026, no additional data dumps have been publicly reported since the initial leak in November 2025. The breach is considered “ongoing” because the attackers may still hold the data and use it over time, not because the platform remains actively compromised.
The Somalia eTAS platform, which all travellers to Somalia, Somaliland, and Puntland must use to apply online, was originally hosted at evisa.gov.so before being migrated to etas.gov.so with no public explanation for the switch. No confirmed containment date has been reported. The Somalia eTAS data breach represents a broader vulnerability in the country’s digital infrastructure, echoing similar incidents affecting other African eTA systems, such as the Kenya eTA platform issues reported in 2024.
What Personal Data Was Exposed in the eTAS Breach?
Confirmed exposed data in the Somalia eTAS data breach includes full names, photographs, dates of birth, marital status, home addresses, and email contacts. CVV and full card numbers were not confirmed compromised. Passport scan exposure, including the Machine Readable Zone (MRZ) data embedded in passport bio-pages, remains unconfirmed but is implied by reports of “sensitive personal data” and the nature of the eTAS application process, which requires applicants to upload passport bio-page images. If MRZ data was exposed, it could enable travel document forgery, as MRZ lines contain passport numbers, holder details, and machine-readable checksums used by border control systems worldwide.
Leaked records began circulating online, including on the social media platform X. The Somalia eTAS data breach exposed fields that heighten identity theft risk, though no reporting confirms financial card data was taken.
| Data Field | Risk Level | Potential Misuse | Recommended Action |
|---|---|---|---|
| Full name & photograph | High | Identity fraud, impersonation | Monitor for fraudulent accounts |
| Date of birth & marital status | High | Account recovery attacks, phishing | Update security questions |
| Home address | High | Physical targeting, extortion | Consider temporary redirection |
| Email contact | Medium | Phishing campaigns, credential stuffing | Enable 2FA, change password |
| Passport scan / MRZ (unconfirmed) | High | Travel document forgery, border control fraud | Contact SICA for verification |
| Payment card CVV/PAN (not confirmed) | Low | No confirmed exposure | Monitor bank statements as precaution |
Travel Advisories and Government Response
13 Nov 2025
US Embassy warned at least 35,000 people affected; recommended FTC and STEP for affected citizens
14 Nov 2025
UK Government issued advisory urging travellers to consider risks; noted breach is ongoing
15 Nov 2025
SICA Director-General Mustafa Sheikh Ali Duhulow called breach reports “coordinated misinformation campaigns”
16 Nov 2025
Agency formally confirmed breach, launched investigation, dismissed Deputy Director Mohamed Kasim; Hussein Abdullahi Sheikh appointed as replacement
No investigation report has been published as of September 2026, and no compensation or credit monitoring programme has been announced for affected applicants. SICA committed to publishing a report and informing affected individuals directly, but no timeline has been provided.
How to Protect Yourself After the eTAS Data Breach
UK applicants affected by the Somalia eTAS data breach should follow seven steps: freeze credit, reset passwords, enable 2FA, monitor bank statements, enrol in CIFAS protection, watch for phishing, and contact SICA for data verification.
Freeze credit or place a fraud alert
Contact Experian, Equifax, or TransUnion to freeze your credit or place a fraud alert.
Change passwords on related accounts
Reset passwords on any accounts using the same email or password as your eTAS application.
Enable two-factor authentication
Turn on 2FA on email and financial accounts for an added layer of security.
Monitor bank and credit card statements
Check your bank and credit card statements for unusual or unauthorised charges.
Enrol in CIFAS Protective Registration
Sign up for CIFAS Protective Registration for added identity-theft defence.
Watch for phishing emails
Be alert for phishing emails referencing Somalia travel; verify any communication before responding.
Check etas.gov.so for post-investigation updates
Monitor etas.gov.so for updates from the Immigration and Citizenship Agency regarding data verification.
Phishing Scams and Reporting the Breach: What UK Applicants Can Do
Somalia eTAS breach victims face elevated phishing risk and should report the incident to the ICO, file identity-theft claims with Action Fraud, and enrol in CIFAS Protective Registration under UK GDPR.
After the Somalia eTAS data breach, leaked personal details began circulating online, including on social media platform X. Attackers exploit this exposed information to craft convincing phishing campaigns targeting applicants. Common scam patterns include fake eTAS renewal emails, fraudulent embassy communications referencing specific travel dates, and WhatsApp messages urging urgent payment. Red flags include urgency language, suspicious sender addresses, unexpected attachments, and payment requests. Verify all Somalia eTAS communications through etas.gov.so before responding.
UK applicants affected by the Somalia eTAS data breach can report to the ICO at, file identity-theft claims with Action Fraud at, and enrol in CIFAS Protective Registration. Under UK GDPR, applicants retain the right to be informed, the right of access, and the right to erasure. Serious cybercrime cases may be escalated to the National Crime Agency.
Is the New etas.gov.so Platform Safe? Risks for Dual Nationals
The replacement etas.gov.so portal uses Cloudflare WAF protection and a CAPTCHA bot-mitigation challenge page, but the Somalia eTAS data breach exposed fundamental gaps in the system’s digital infrastructure. The platform was migrated from evisa.gov.so to etas.gov.so with no published explanation, and as of September 2026 there is no visible SOC 2 audit, no published security audit, and no pre-login privacy policy.
UK-based Somali dual nationals face heightened physical-security risks because the Somalia eTAS data breach exposed home addresses alongside Somalia travel dates. Somaliland’s Foreign Minister Abdirahman Dahir Aadan stated the system was “not safe and people’s data can fall into the hands of extremist groups.” Somaliland rejects the Somalia e-visa entirely and offers visa-on-arrival at Hargeisa Airport, while an airspace dispute between Somaliland and Mogadishu has already resulted in airline diversions.
Applicants should use a VPN, avoid public Wi-Fi, and consider waiting for the SICA investigation to conclude before submitting new applications. No policy has been issued confirming or revoking previously issued e-visas. Dual nationals may redirect correspondence to a temporary address as a precaution.
This article is for informational purposes only and does not constitute legal advice. Affected applicants should consult a data protection solicitor for personalised guidance. We are not affiliated with the Somali Immigration and Citizenship Agency or etas.gov.so.
Frequently Asked Questions (FAQ) About the Somalia eTAS Data Breach
When did the Somalia eTAS data breach happen and who was affected?
The Somalia eTAS data breach was discovered on 11 November 2025. Unidentified hackers accessed the Somali government’s e-visa platform, compromising the personal data of over 35,000 applicants, including both UK and US citizens who applied for travel authorization.
Were my credit card details compromised in the Somalia eTAS breach?
No. CVV and full card numbers were not confirmed compromised in the incident. However, the Somalia eTAS data breach did expose full names, photographs, dates of birth, marital status, home addresses, and email contacts of applicants.
How do I know if my data was in the Somalia eTAS breach?
No verified self-check tool exists for the public. You should contact the Immigration and Citizenship Agency (SICA) via etas.gov.so and assume your data was exposed if you submitted a Somalia eTAS application before November 2025.
Is my previously approved Somalia e-visa still valid?
As of September 2026, no policy has been issued by the Immigration and Citizenship Agency confirming or revoking pre-breach Somalia e-visas. You should monitor the etas.gov.so portal for direct updates regarding your travel authorization validity.
What should I do right now if I applied for a Somalia eTA?
UK applicants affected by the Somalia eTAS data breach should immediately freeze credit with Experian, Equifax, or TransUnion, reset all related passwords, enable two-factor authentication, monitor bank and financial statements, enrol in CIFAS Protective Registration, and watch for phishing emails referencing Somalia travel.
How can I tell if an email about the Somalia eTAS breach is a phishing scam?
Phishing emails following the Somalia eTAS data breach often use urgency language, suspicious sender addresses, unexpected attachments, or urgent payment requests. You must verify all communications through the etas.gov.so portal before responding to any Somalia eTAS message.
Can I get a refund or compensation for the Somalia eTA fee after the breach?
No financial compensation, credit monitoring, or fee reimbursement programme has been announced by the Somali government for Somalia eTAS data breach victims as of September 2026. You should continue to monitor etas.gov.so for any future announcements.
Should I report the Somalia eTAS data breach to the UK ICO?
Yes. UK-based Somalia eTAS breach victims should report the cybersecurity incident to the ICO at, file identity-theft claims with Action Fraud at, and enrol in CIFAS Protective Registration to safeguard their exposed personal data from further compromise.
