U.S. Embassy warns of suspected breach in Somalia’s e‑visa system, thousands of travelers at risk
The United States Embassy in Mogadishu has issued a security alert warning that a suspected cyber intrusion into Somalia’s electronic visa platform may have exposed the personal data of tens of thousands of applicants — a reminder that the global rush to digitize borders carries risks as well as convenience.
- Advertisement -
In a notice released this week, the embassy said it received credible reports on November 11, 2025, that unidentified hackers had penetrated the Federal Government of Somalia’s e‑visa infrastructure. The breach is believed to involve at least 35,000 applications — potentially including thousands of U.S. citizens — though the embassy stressed it cannot confirm whether any one individual’s data was exposed.
The information allegedly accessed includes names, photographs, dates and places of birth, email addresses, marital status and home addresses. That is precisely the kind of personally identifiable information that, in the wrong hands, is useful for identity theft, spear‑phishing and other forms of fraud.
Embassy urges applicants to assume exposure
While the scale and technical details have not been publicly confirmed by Somali authorities, the embassy’s advice was stark: anyone who has applied for a Somali e‑visa should proceed as if their data may have been compromised. As of publication time, Mogadishu had not issued a public statement addressing the reports.
“When you digitize borders, the gate becomes a database,” one regional cybersecurity consultant told Axadle Times by phone, speaking generally and not about this system in particular. “The same qualities that make these platforms efficient for travelers also make them attractive to attackers.”
A young system under scrutiny
Somalia launched its mandatory e‑visa and travel authorization platform on September 1, 2025, calling it a major upgrade for security screening and financial transparency. The system requires all foreign travelers to apply online before arrival, part of a broader push to modernize public services and reduce cash-based transactions at airports.
The rollout, however, has been complicated by politics. North Western State of Somalia and Puntland State publicly rejected the federal e‑visa regime. Hargeisa has insisted that only documents issued by its own immigration authority are valid in its territory, while Puntland State called the federal e‑visa “illegal,” asserting that regional administrations retain authority over airports and borders. That political friction did not stop many travelers — aid workers, businesspeople, diaspora families — from using the federal platform for flights into Mogadishu and other cities.
Why this matters beyond Somalia
Digital gateways like e‑visas and online travel authorizations are now standard around the world. They speed up arrivals and help governments screen travelers before they board. But they also aggregate sensitive data in central repositories, and those repositories are tempting targets. In recent years, cybercriminals and state‑linked actors have probed government systems across Africa, Europe and Asia, often looking for databases rich with identity details.
Somalia’s suspected breach lands at the intersection of two global trends: a rapid migration of government services to cloud-based platforms, and an equally rapid rise in opportunistic data theft. The pressure to digitize — to keep pace with neighbors, streamline revenue collection, comply with airline systems — is real. So is the obligation to invest in cyber hygiene, from basic patching and access controls to third‑party audits and incident response drills.
For countries rebuilding institutions after conflict, the challenge is steeper. Donors and private vendors can help stand up systems quickly, but strong procurement, local capacity and clear lines of accountability take longer to build. The question isn’t whether to digitize — it’s how to do so safely, and what safeguards are in place when things go wrong.
What travelers can do now
For applicants who used Somalia’s e‑visa, the immediate steps are familiar but important. Cybersecurity professionals recommend the following:
- Be alert for phishing: Watch for emails or messages that reference your travel, visa status, passport or itinerary. Avoid clicking links or downloading attachments you weren’t expecting.
- Change passwords: Update passwords for the email address used in the application and any related accounts. Use a unique, strong passphrase and enable two‑factor authentication where possible.
- Monitor financial activity: Keep an eye on credit card and bank statements for unusual charges. Consider setting up alerts with your bank.
- Check government guidance: U.S. citizens can review identity theft resources at identitytheft.gov and enroll in the State Department’s Smart Traveler Enrollment Program (STEP). Travelers of other nationalities should consult their home country’s consumer protection and cyber incident resources.
- Limit data reuse: If you must upload documents to other platforms, redact sensitive details when permissible and avoid reusing the same password across services.
Open questions for authorities
For Somali officials, critical questions now include: When was the system first compromised? What components were affected? Has the threat actor been removed? How many records were accessed, and do logs exist to verify? Are passwords, passport numbers or payment details at risk? And just as crucially, how will affected individuals be notified and supported?
Cybersecurity experts say an independent, time‑bound forensic review is standard in such cases, along with transparent public updates and, where applicable, coordination with international partners. Clear communication can limit panic, reduce the success of follow‑on scams and help travelers take practical steps to protect themselves.
Travel still possible, caution advised
There is no indication at this stage that the suspected breach is disrupting flights into Somalia or preventing travelers from obtaining visas. Airlines and airports continue to require documentation on arrival. But the episode underscores a broader reality for global travelers: your most valuable travel document may be the data trail you leave behind, long before you join the line at passport control.
In Mogadishu’s airport, where the summer heat lingers even after dusk and families gather at arrivals with flowers and flags, the promise of a frictionless digital border is enticing. It’s also fragile. As more governments build services online, public trust will hinge on how they guard the information that now stands in for our identities — and how swiftly they act when that trust is shaken.
For now, applicants are being told to assume the worst and prepare accordingly. The breach, if confirmed, will not be the last of its kind. The measure of progress may be how quickly countries learn to make these systems not just faster, but safer.
By Ali Musa
Axadle Times international–Monitoring.
