A major data breach in Somalia’s electronic visa system may have exposed personal information belonging to tens of thousands of applicants, including US citizens, the American embassy in Somalia has warned.
It said it had received credible reports that “unidentified hackers” had penetrated the Somali government’s e-visa platform, potentially compromising data from at least 35,000 people.
The leaked documents circulating online include names, photos, dates of birth, marital status, home addresses and email contacts, according to a US embassy statement issued on Thursday.
“This data breach is ongoing and could expose any personal data you enter into the system,” the UK has also warned travellers.
“Consider the risks before applying for an e-visa required for travel to Somalia.”
Somali authorities have not commented on the breach. But the government has shifted its visa service from evisa.gov.so to etas.gov.so, without providing an official explanation.
“While Embassy Mogadishu is unable to confirm whether an individual’s data is part of the breach, individuals who have applied for a Somali e-visa may be affected,” the US’ statement said.
The BBC has contacted the Somalia Civil Aviation Authority (SCAA) for comment.
Somalia’s new system requires all travellers, including those from the self-declared republic of Somaliland and the semi-autonomous region of Puntland, to apply for entry visas online.
Critics say travellers have faced extra fees in certain regions, amounting to double charges.
Somaliland, which declared independence in 1991, governs itself with its own institutions but has not been internationally recognised. Somalia maintains that the region remains part of its sovereign territory.
The alleged breach adds to long-running tensions between Mogadishu and Hargeisa over control of Somali airspace. While Somalia re-established full control of its airspace in 2017, Somaliland continues to contest the arrangement.
The dispute escalated further this week when Somaliland’s President Abdirahman Irro said Somaliland would not accept Somalia’s e-visa and ordered that airlines must obtain clearance from Hargeisa before entering its airspace.
Yet major airlines have refused to board passengers without Somalia’s e-visa approval.
On Saturday, Somaliland’s Foreign Minister Abdirahman Dahir Aadan again insisted that “anyone travelling to Somaliland will obtain their visa on arrival”, saying Somalia’s e-visa system was not safe and warning that “people’s data can fall into the hands of extremist groups” as a result of using it.
The stand-off has left some travellers heading to Somaliland stranded at airports after being denied boarding for lacking Somalia’s e-visa.
Somaliland’s Civil Aviation Minister, Fu’aad Ahmed Nuux, has told the BBC that the directives – first announced earlier this year – came into effect on 10 November.
He said airlines that do not comply will be told to divert, and claimed several aircraft had already been rerouted.
Footage released by Somaliland’s aviation ministry appears to show local air-traffic controllers issuing instructions to international pilots – a move celebrated domestically as an assertion of Somaliland’s autonomy.
But the Somalia Civil Aviation Authority insists it retains sole administrative and legal control over the Mogadishu Flight Information Region (FIR), which covers the whole nation’s airspace. It has ordered all aircraft to ignore any instructions issued by authorities other than Mogadishu.
It warned that failing to comply with Somali and international aviation rules could pose safety risks and lead to “serious legal consequences”.
Additional reporting by Natasha Booty.
