The admission marks the first official acknowledgement by Somali authorities on Sunday after the United States and United Kingdom issued warnings earlier in the week. At least 35,000 people, including thousands of American citizens, may have had their data compromised when “unidentified hackers” penetrated the system, according to a US Embassy statement issued on November 13.

Somalia’s Defense Minister Ahmed Moalim Fiqi had praised the electronic visa system this week, claiming it had successfully prevented ISIL (ISIS) fighters from entering the country, as a months-long battle continued in the northern regions against a local affiliate of the group. The leak came to wider attention last week after clusters of accounts on the social media platform X began circulating what they claimed was personal information from affected individuals.

The breach has cast a spotlight on the vulnerabilities of a digital system that Somalia’s government had promoted as essential for improving national security. The immigration agency said it was treating the issue with “special importance” and announced it has launched an investigation into the issue. The agency said it was investigating “the extent of the attempted breach, its origin, and any potential impact”, adding that a report would be published and those affected would be informed directly. However, the statement did not indicate how many people were affected, nor did it give any sense of how long the process might take. The government has since quietly moved its e-visa system to a new website.

The UK embassy warned travellers on November 14 that “this data breach is ongoing and could expose any personal data you enter into the system,” advising people to “consider the risks before applying for an e-visa”. Mohamed Ibrahim, a former Somali telecommunications minister and tech expert, told Al Jazeera that while hacking is a significant challenge, the authorities’ lack of transparency is troubling. “Somalia isn’t high-tech, and hacking, in itself, is neither here nor there. But they should have been upfront with the public,” Ibrahim said. “Why was the website’s URL changed, for example? That hasn’t even been explained,” he added, referring to the domain name change for the e-visa application site. (Al Jazeera/Reuters)