Somalia confirms major data breach in electronic visa system

Officials launch probe days after breach emerged amid widespread concern and speculation over leaked data.

Somalia’s Immigration and Citizenship Agency has confirmed that hackers breached its electronic visa platform, exposing sensitive personal data of travellers who used the system.

The admission on Sunday marks the first official acknowledgement by Somali authorities after the United States and United Kingdom issued warnings earlier in the week.

Recommended Stories

• list 1 of 2Somalia embraces Swahili to strengthen East African Community ties
• list 2 of 2EU naval force says tanker freed from pirates off coast of Somalia

At least 35,000 people, including thousands of American citizens, may have had their data compromised when “unidentified hackers” penetrated the system, according to a US Embassy statement issued on November 13.

Somalia’s Defence Minister Ahmed Moalim Fiqi had praised the electronic visa system this week, claiming it had successfully prevented ISIL (ISIS) fighters from entering the country, as a months-long battle continued in the northern regions against a local affiliate of the group.

The leak came to wider attention last week after clusters of accounts on the social media platform X began circulating what they claimed was personal information from affected individuals.

The breach has cast a spotlight on the vulnerabilities of a digital system that Somalia’s government had promoted as essential for improving national security.

The immigration agency said it was treating the issue with “special importance” and announced it has launched an investigation into the issue.

The agency said it was investigating “the extent of the attempted breach, its origin, and any potential impact”, adding that a report would be published and those affected would be informed directly.

However, the statement did not indicate how many people were affected, nor did it give any sense of how long the process might take.

The government has since quietly moved its e-visa system to a new website.

The UK embassy warned travellers on November 14 that “this data breach is ongoing and could expose any personal data you enter into the system,” advising people to “consider the risks before applying for an e-visa”.

Mohamed Ibrahim, a former Somali telecommunications minister and tech expert, told Al Jazeera that while hacking is a significant challenge, the authorities’ lack of transparency is troubling.

“Somalia isn’t high-tech, and hacking, in itself, is neither here nor there. But they should have been upfront with the public,” Ibrahim said.

“Why was the website’s URL changed, for example? That hasn’t even been explained,” he added, referring to the domain name change for the e-visa application site.

On Saturday, the Somali immigration agency’s director-general dismissed media reports about the breach as “coordinated misinformation campaigns” intended to undermine state institutions.

“A Somali individual cannot undermine the dignity, authority, honour or unity of the state,” Mustafa Sheikh Ali Duhulow told an audience in Mogadishu on Saturday night, without directly addressing the hacking allegations.

The breach has sparked fury among officials in Somaliland, the breakaway region that declared independence from Somalia in 1991, who have generally resisted attempts by Mogadishu to impose control over the territory.

Mohamed Hagi, an adviser to Somaliland’s president, called Mogadishu’s administration “institutionally irresponsible” for keeping the visa portal active despite the breach.

The incident came amid escalating tensions between Somalia and Somaliland over airspace control.

Somalia’s government has been working to tighten control of its national airspace and centralise visa procedures, despite authority in the country being fragmented among autonomous regional states.

Just one day before the breach emerged, Somaliland declared that “entry visas issued by the Federal Government of Somalia bear no legal validity” within its territory.