A cybersecurity breach in Somalia’s electronic visa (e-visa) system has exposed the personal data of 35,000 travelers, including citizens from South Africa, Uganda, Somalia, and Ethiopia, with Kenya topping the list globally with over 13,000 affected.
- A cybersecurity breach in Somalia’s e-visa system exposed personal details of 35,000 travelers.
- The breach affected individuals from 25 nations, including African countries like South Africa, Kenya, Uganda, and Ethiopia.
- Sensitive data such as names, passport numbers, birth dates, and banking details were compromised.
- The flaw was a simple verification issue allowing unauthorized access to records without authentication.
A major cybersecurity failure in Somalia’s electronic visa (e-visa) system has left 35,000 travelers from 25 countries, including five African nations, exposed to identity theft and financial fraud.
The breach, independently verified by Somaliland Chronicle, compromised personal data such as full names, passport numbers, dates of birth, passport photos, and banking information used for visa payments.
Security experts warn that the exposed information is now circulating in criminal networks and could be exploited for fraud or by terrorist groups, including Al-Shabaab, making this one of the most serious digital security incidents affecting international travelers in the region.
Uncovering the Facts
The breach, independently verified by Somaliland Chronicle, was discovered by Abdi Daud, Lead Architect and enterprise systems expert.
The flaw resides in the verification endpoint of the e-visa system, which requires no authentication, authorization, or rate limiting, allowing anyone with internet access to sequentially access applicants’ sensitive data.
“This isn’t hacking; it’s counting,” Daud said. “I accessed multiple records in 30 minutes with a script that took 10 minutes to write. The vulnerability is alarmingly simple, but the consequences are catastrophic.”
This data has already circulated in criminal networks, creating high risks of financial fraud, account compromise, and identity theft.
Among the most affected are citizens of Kenya (13,325), the United Kingdom (3,027), and the United States (2,298), along with travelers from the Netherlands, Colombia, Sweden, Canada, India, and Somalia itself.
Reports suggest that the US government had found “credible” evidence indicating Somalia’s newly launched e-visa system, which went live just two months earlier, had been infiltrated by unauthorized actors.
According to the US Embassy in Mogadishu, the breach occurred on November 11, potentially exposing the personal data of at least 35,000 applicants.
The UK followed with a warning on November 14, stating the breach is ongoing and could expose any personal data entered into the system. “Consider the risks before applying for an e-visa for travel to Somalia,” the embassy advised.
The incident has drawn criticism from Somali tech and security experts. Mohamed Ibrahim, a former telecommunications minister, told Al Jazeera that while hacking is a global challenge, the authorities’ response has been inadequate. .
The exposure is particularly dangerous because the leaked data is now accessible to Al-Shabaab, a U.S.- and UK-designated terrorist group responsible for several deadly attacks.
The breach provides verified intelligence on travelers’ identities, nationalities, photographs, and travel histories, creating a pre-vetted target list for kidnappings, assassinations, and other attacks.
Authorities are urging affected travelers to immediately contact banks, monitor financial accounts, and change passwords.
For Somalia, the incident highlights the urgent need to secure digital systems in conflict zones, where negligent architecture can translate directly into life-threatening risks.
