UK MoD data breach exposed 18,500 Afghans; super-injunction hid failure

A parliamentary inquiry has revealed that a "foreseeable systemic failure" within the UK Ministry of Defence (MoD) led to a massive data breach, exposing the personal details of more than 18,500 Afghans seeking relocation to the UK. The breach left thousands of allies who worked with British forces vulnerable to Taliban reprisals.

The Commons Defence Committee found that the leak occurred when a staff member shared an Excel spreadsheet containing sensitive applicant data with a "trusted third party." This incident was one of 19 data security breaches reported between February 2022 and November 2023. To prevent public disclosure, the MoD utilized an unprecedented super-injunction that blocked reporting on the breach from August 2023 until July 2025. Additionally, a subsequent review overturned 884 wrongful rejections of Afghan special forces, known as "Triples," who had been erroneously denied resettlement.

Administrative Failures

Following the 2021 Taliban takeover of Kabul, the UK established the Afghan Relocations and Assistance Policy (Arap) to protect its local partners. However, the inquiry highlighted a critical lack of expertise within the MoD to manage complex immigration casework. The department relied on insecure tools, such as Excel, and maintained a "neither confirm nor deny" policy regarding Special Forces involvement to avoid accountability. Tan Dhesi, Chair of the Defence Committee, stated that the MoD "should stick to defence" and should never have been tasked with running immigration schemes.

Cost of Secrecy

The fallout from the breach has resulted in significant financial and ethical costs. In April 2024, the MoD launched the Afghanistan Response Route (ARR) specifically to resettle those endangered by the data leak. The government expects to relocate 7,355 people through this route at an estimated cost of £850 million. Dhesi further criticized the government's culture, noting that secrecy had been used as a "shield against proper accountability" in areas unrelated to sensitive military operations.

Next Steps

An MoD spokesperson acknowledged the incident, stating it "should never have happened" and admitting the significant impact on those affected. While the ARR scheme is underway, the incident has sparked a broader debate over the UK's duty of care toward foreign allies and the legality of using super-injunctions to mask administrative incompetence. Observers now await further details on how the MoD intends to overhaul its data security protocols to prevent similar systemic collapses.