Tech
UK Visa Portal exposed thousands of applicants’ passports and selfies — then called the lawyers on us
A website called UK Visa Portal publicly exposed thousands of passports and selfie photos of applicants who paid the site to obtain a U.K. immigration visa, TechCrunch has learned.
An anonymous person notified TechCrunch about the security lapse, saying that the website was exposing at least 100,000 documents from people who uploaded their passports and selfies to the website as part of the application process.
The website is not affiliated with the U.K. government, and some have complained that they mistakenly paid a fee to this company instead of using the official GOV.UK website.
The exposed data was secured overnight into Wednesday, hours after we published our initial story about the incident. Given the highly sensitive nature of the exposed data, TechCrunch revealed that there was an ongoing security issue, while withholding specific details to minimize any additional risk to individuals’ private information.
TechCrunch has still not heard back from UK Visa Portal’s management. Rather than fixing the issue when we reached out, the company sent its attorneys and public relations firm our way instead.
The security lapse is the latest example of companies publicly exposing their customers’ sensitive government-issued identity documents in recent weeks, often caused by a misconfiguration rather than an outside cyberattack. The exposure of passports is especially problematic at a time when online identity checks are on the rise around the world, thanks to governments rolling out age-verification laws.
The company’s lack of response also leaves open questions about whether it will alert affected customers that their passports were publicly exposed, or notify regulators as required under U.S. state and European data breach notification laws.
Exposed passports, selfies, and location data
The data spill stemmed from a public Amazon-hosted storage server (also known as a bucket), which UK Visa Portal uses for hosting user-uploaded passports and selfies.
While the bucket was not publicly listing its contents, the files within were still accessible and viewable to anyone who knew the web address of each file. The person who notified us about the exposure said a bug on the UK Visa Portal website’s back end allowed them to view the list of files contained in the bucket.
TechCrunch confirmed that UK Visa Portal (also known as UK Visit and ETA-Pass) was the source of the data leak and verified the authenticity of the exposed data by contacting affected individuals to ask if their information was accurate.
Many of the user-uploaded photos also contained the precise real-world location, revealing where the images were taken; in some cases, this location data was accurate enough to expose the image taker’s home address.
UK Visa Portal does not provide a way to report security issues through its website, nor does its website provide names or contact information for the company’s management. TechCrunch sent an email to the email address listed on UK Visa Portal’s website, alerting them that the company had an ongoing security lapse and asking with whom in management we could share details to resolve the issue. TechCrunch explained that we could not share specifics with the company’s general customer support inbox because we could not guarantee that the exposed data would not be misused.
The customer support person provided TechCrunch with the name and email address of Michael Taylor, who we were told is a manager at UK Visa Portal. The person did not reply to our inquiry.
Soon after, attorneys with U.S. law firm BakerHostetler and representatives with public relations firm FTI Consulting contacted TechCrunch seeking information about the issue at UK Visa Portal. When asked by TechCrunch, the attorneys would not provide evidence that they were authorized to speak on behalf of the company, such as by providing us a public record confirming the name and role of the individuals they claim to represent. We noted again that we could not share information about the security lapse outside of the company’s management.
We added that if Taylor, or another manager, is willing to accept information about the security lapse, they can reach out — or the attorneys can copy them on the email thread. We did not hear back.
After our story was published and the bucket secured, TechCrunch presented the attorneys with a series of questions about the security lapse. The questions we asked BakerHostetler partner Ryan Christian included how long the Amazon-hosted bucket was exposed, the reason it was exposed, and if the company had any logs to determine if anyone accessed or downloaded the exposed data. We also asked who at UK Visa Portal is responsible for cybersecurity, if anyone. Christian did not respond.
UK Visa Portal is allegedly run by a company called Active Leadgen LLC, which purports to be a company based in the United Arab Emirates. TechCrunch could not independently corroborate this.
It is not necessary to use a third-party service to apply for a U.K. electronic travel authorization, unless you are retaining an immigration attorney, and applicants should apply through the U.K. government’s website.
First published on May 26 and updated with additional information about the security lapse.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
Glean’s top line crosses $300M as AI budget cutting becomes its major selling point
Glean, a company often described as the Google for enterprise, said it has reached $300 million in annual recurring revenue (ARR), a three-fold increase from the $100 million milestone it reached just 15 months ago.
While many AI startups are growing at a blistering pace, Glean’s progress is particularly remarkable. After years of essentially being the only player in the category, the seven-year-old startup is accelerating its growth as tech giants enter the enterprise AI search market with rival products.
“The first four or five years of our existence, we had no competition,” Glean CEO Arvind Jain told TechCrunch. “Given how important search is to make AI work in the enterprise, every single company in the world wants to be in this space.”
Tech heavyweights building Glean-like tools include Google, Microsoft, OpenAI, Anthropic, Salesforce, and Atlassian.
Jain maintains there’s value in being a first mover in the space, but that it’s also equally important to offer a better product.
What Glean does better than its competition, according to Jain, comes down to the deep understanding that its AI tools have of customers’ business needs. Glean’s AI achieves this knowledge — a concept captured by the new, popular term “context graph” — by connecting to and learning from enterprises’ internal software systems.
Jain claims that Glean’s context graph also helps enterprises cut AI computing costs.
“If you connect your AI to Glean, it gives you all the information that you need to do your work, and that results in AI consuming far fewer tokens compared to if you unleash AI onto your systems directly,” Jain said. That’s because with Glean, AI ends up performing fewer operations, he added.
At a time when many companies are blowing through their AI budgets, those token cost savings have become a major selling point for the company.
“One of the things you know our customers really like about Glean is the fact that we can reduce your AI bill significantly,” he said.
The company, which was last valued at $7.2 billion when it raised a $150 million Series F last June, offers various pricing structures to its customers, which include Databricks, Reddit, Pinterest, and Samsung.
According to Jain, Glean offers both a consumption-based model, where clients pay per use, and a hybrid model that combines a fixed monthly fee for active users with separate usage fees for model consumption.
Glean is definitely not the first company to do this, but it’s worth pointing out that the company’s $300 million milestone cannot be fully described as traditional ARR, because a consumption model by definition doesn’t have a strictly recurring component.
Pure consumption pricing models depend on fluctuating user activity rather than predictable subscription renewals, therefore a portion of Glean’s top line is more accurately described as an annualized revenue run rate.
Glean did not immediately respond to a request for comment; this post will be updated if the company replies.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
Final 24 hours to save up to $410 on your TechCrunch Disrupt 2026 ticket
This is it. The countdown is almost over. You now have until tonight at 11:59 p.m. PT to lock in Early Bird savings of up to $410 for TechCrunch Disrupt 2026 before prices increase.
If Disrupt has been on your must-attend list, this is your final chance to secure the lowest available rates before the next price jump hits. Once the deadline passes, so do the savings.
Register now and join 10,000+ founders, investors, operators, and innovators at Moscone West in San Francisco from October 13–15 for three days packed with networking, startup discovery, and conversations shaping the future of tech. Bring a plus-one at 50%, or bring a group to get an up to 30% discount.
What makes Disrupt worth attending year after year
TechCrunch Disrupt is where startup momentum accelerates. The event brings together the people actively building, funding, and scaling what’s next across AI, fintech, SaaS, climate, cybersecurity, consumer tech, and beyond.
Attendees come to Disrupt for:
- Direct access to investors, founders, and operators making moves now.
- Conversations that lead to partnerships, funding, and hires.
- Tactical insights from leaders scaling breakout companies.
- An inside look at emerging technologies before they hit the mainstream.
With 300+ exhibiting startups, Startup Battlefield 200, curated networking experiences, and multiple stages of programming, Disrupt is built to help attendees make meaningful connections and real business progress.
Built for the people shaping what’s next
Disrupt is designed for founders raising capital, investors sourcing opportunities, operators scaling companies, and innovators looking for an edge. Whether you’re launching your next startup, growing your network, or tracking the future of technology, Disrupt puts you in the room with the people driving the industry forward.
Hear directly from tech leaders shaping the industry
Every year, Disrupt brings together hundreds of influential voices across startups and venture capital. Past speakers have included leaders from the companies and firms shaping the future of AI, enterprise software, fintech, consumer tech, and more.
This year will deliver the same high-caliber experience, with 200+ sessions across six industry-focused stages, plus roundtables and breakouts covering scaling, AI, fintech, infrastructure, robotics, and emerging technologies. Explore the growing agenda to see the latest sessions and speaker announcements.
Speakers include:
Savings of up to $410 end tonight at 11:59 p.m. PT
Early Bird savings of up to $410 end tonight at 11:59 p.m. PT. After that, ticket prices increase.
Register now to secure your TechCrunch Disrupt 2026 pass at a low rate before the deadline expires. Bringing more than just you? Save 50% on a second ticket, or up to 30% on community passes.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
Today is the last day to apply to speak at TechCrunch Disrupt 2026
TechCrunch Disrupt 2026 returns October 13–15 to Moscone West in San Francisco — and applications to speak are open for just a few more hours.
We’re inviting founders, investors, operators, and technology experts to apply for a chance to take the stage at one of the most influential tech events of the year.
More than 10,000 startup and VC leaders will gather at Disrupt 2026 to explore what’s next in AI, scaling, fintech, infrastructure, robotics, and the future of innovation.
Applications close tonight at 11:59 p.m. PT. Apply now to share your expertise and help shape the conversations defining the tech industry.
Pick your session format
We’re looking for high-impact speakers to lead one of two session types:
Breakout Sessions: A 30-minute talk (up to 4 speakers, including a moderator) with a 20-minute audience Q&A. Capacity: 100 attendees.
Roundtables: A 30-minute speaker-led group discussion, designed for up to 40 participants. No slides or AV — just insight and conversation.
How the application process works
Each application will be carefully reviewed by our editorial team. Finalists will be selected for the Audience Choice vote — where TechCrunch readers choose which sessions make it to the Disrupt Stage. Learn more about speaking on Disrupt’s Call for Content page.
Lead the conversation at Disrupt 2026
If you have actionable insights, real-world experience, and a desire to contribute meaningfully to the tech ecosystem, we want to hear from you. Submit your application before today’s deadline.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tigers' Jack Flaherty, facing Angels, searches for first win of season
White Sox ride lineup momentum into series finale against Twins
