Somalia admits major Data breach after days of denial

Somalia’s Immigration and Citizenship Agency has, for the first time, acknowledged a data breach, announcing that it is investigating an unlawful intrusion into parts of the country’s electronic travel authorization system (e-TAS). The confirmation has triggered a national-level response aimed at containing the incident and assessing its impact, the agency said.

This development comes just a day after the agency’s chairman publicly dismissed initial reports of a breach as “propaganda,” urging the public to disregard unverified claims and support the agency’s efforts. His remarks were followed by today’s formal confirmation from the agency that a breach had indeed occurred and was under investigation.

In a statement released today, the agency said it had identified “an unlawful breach that targeted parts of the data belonging to Somalia’s travel system.” The agency reported that they acted quickly to isolate the affected systems and launch an inquiry as soon as the intrusion was discovered.

The Federal Government of Somalia has established a national investigative committee to lead the probe, the statement noted. The panel includes “security agencies, international forensic experts, and government bodies responsible for data protection.” According to the agency, the committee is examining how the breach occurred, the extent of the exposure, and any potential risks to citizens or travelers. The agency added that “once the official investigation is completed, a detailed report will be released, explaining the findings, confirming the facts, and outlining the corrective measures taken.” It also stated that “all individuals who may have been affected will be informed directly, and only official government communication channels.”

In recent weeks, widespread reports have circulated on social media alleging a security breach in Somalia’s electronic visa (e-visa) platform. Anonymous sources claiming links to hacking groups have asserted that they took control of the system and released a large cache of sensitive documents belonging to visa applicants from various countries.

According to those claims, more than 35,000 passport records may have been compromised. The leaked materials reportedly include scanned identification documents, biometric data, personal contact information, and other supporting files. Among those said to be affected are diplomats, humanitarian workers, and foreign contractors.

Despite indications of a large-scale breach, the government initially remained silent. The lack of an early formal response prompted international partners to issue their own statements. On November 11, 2025, the U.S. Embassy in Mogadishu released a security advisory acknowledging that “multiple sources reported credible allegations” of a cyber intrusion into the e-visa platform. The embassy warned that the breach may have exposed the personal information of at least 35,000 individuals, potentially including thousands of U.S. citizens. The United Kingdom’s Foreign Travel Advisory issued similar guidance, cautioning travelers about the ongoing nature of the breach and urging them to carefully consider the risks before submitting e-visa applications.

The acknowledgment of the breach, following weeks of silence, marks what appears to be the most significant cybersecurity incident ever recorded in Somalia. The event has raised serious concerns about the country's ability to safeguard digital information and the effectiveness of its national institutions, especially at a time when the government is actively promoting the digitalization of the country.

Read our earlier reporting.