Inquiry finds MoD Afghan data breach was foreseeable failure

A data breach that exposed personal details of thousands of Afghans applying to come to the UK to flee the Taliban was a "foreseeable" failure, a parliamentary inquiry has found.

Britain set up scheme to bring those thought to be the most in danger to safety

In a report published on Thursday, the Commons' Defence Committee said the Ministry of Defence (MoD) had lacked the expertise to run the UK's Afghan relocation scheme after the fall of Kabul to the Taliban and had used secrecy as a "shield" against proper accountability.

The breach came to light in August 2023 but an unprecedented super-injunction prevented it from being reported on until July 2025.

A MoD spokesperson said the leak "should never have happened" and welcomed the opportunity to learn from the incident.

Man's anger as brother left in Afghanistan after data breach

A super-injunction is a court-mandated gagging order that forbids news outlets from reporting private or sensitive information.

It also bans the media from revealing that the injunction exists.

The leak was not "an individual mistake" but a "foreseeable systemic failure" caused by "inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability", the Defence Committee said in its report.

The breach, just one of 19 reported between February 2022 and November 2023, was caused by a member of MoD personnel sharing a Microsoft Excel spreadsheet with a "trusted third party", the committee added. The BBC previously revealed the breach had originated from UK Special Forces (UKSF) headquarters.

The spreadsheet contained data of more than 18,500 applicants to the Afghan Relocations and Assistance Policy (Arap) scheme - every person who had applied to the scheme by January 2022.

Arap was set up in April 2021 to help people who feared their lives were at risk because they had worked with British armed forces in Afghanistan and to resettle eligible applicants and their family members in the UK. It was closed in July 2025.

Committee chairman Tan Dhesi said: "The Ministry of Defence should stick to defence - it should never have been left to run immigration casework schemes."

The report branded the MoD's use of Excel a "continuing cultural failure" and described the wider Afghan relocation scheme as "utterly and obviously inadequate".

Dhesi also hit out at the secrecy surrounding the breach and said the length of the super-injunction "imposed serious costs on accountability and trust".

It was originally expected to last four months, the report found, but remained in place for almost two years.

What we know so far about Afghan data breach

How bad is Afghan data breach for MI6 and SAS?

The committee also questioned the decision not to provide confidential briefing to parliamentarians, with then-Defence Secretary Grant Shapps pushing back against plans to tell then-shadow defence secretary John Healey of the breach.

The committee added that special forces involvement "should not prevent Parliament and the public from understanding how administrative failings occurred".

Dhesi said: "Secrecy has been too easily used as a shield against proper accountability in areas far removed from sensitive operations."

The role of UKSF in the resettlement scheme was also questioned by the committee after reports the breach had been due to their involvement in deciding whether to relocate Afghan special forces.

The committee was unable to establish this connection, due to the "neither confirm nor deny" policy of the government, but it did raise concerns over the handling of these cases.

In February 2024, BBC Panorama revealed that British Special Forces had been given a de facto veto over Arap applications from their Afghan counterparts seeking to relocate to safety in the UK.

Afghan special forces served alongside UKSF on some of the conflict's most dangerous missions and are considered among those at the highest risk of reprisal since the Taliban takeover.

Last year, the BBC obtained internal MoD documents - also cited in the report - showing a British Special Forces officer personally rejected 1,585 resettlement applications from Afghans with credible links to special forces in a matter of weeks, in 2023. The UKSF officer did not approve a single application during that period.

The rejections from UKSF left many in fear for their lives and former members of the Afghan special forces told the BBC they were living in hiding.

One said he had been interrogated and beaten by the Taliban before he went on the run, while another said he had escaped first but had heard the Taliban had gone to his home looking for him.

"I'm living in a very bad situation. I am in hiding and mostly my family can't live together and we cannot go out and we cannot work," he said. "I feel I have been left alone in the midst of hell."

The government had to announce a review in 2024 and since then 884 former members of Afghan special forces, who served alongside UKSF, have since had their rejections overturned.

The defence committee report outlined that the "proportion of decisions subsequently overturned demonstrates the seriousness of that failure".

The UK government closed Arap to new applications in 2025, but the report said the government had a "special responsibility" to the Afghan special forces it had wrongly rejected. Many of them had made their applications in 2021, but were still living in fear due to "government delay or error".

The defence secretary currently faces a legal challenge at the Royal Courts of Justice from former Afghan special forces who are unable to escape to the UK.

In a hearing on Wednesday, the court heard one family had "$200 left to survive".

A MoD spokesperson said: "This incident should never have happened and we acknowledge the significant impact it has had on many people.

"Thousands of eligible Afghans have already been safely relocated to the UK, where they can rebuild their lives and we are committed to ensuring that we conclude the Afghan resettlement programme by the end of this Parliament.

"We are learning the lessons from this incident and important reforms are already in place, including improved data protection standards, strengthened case-working processes and better programme governance.

"We welcome the public and parliamentary scrutiny of our actions, so we can learn more and be held to account, and we'll continue to work closely with the committee on this issue."

Afghans resettled in UK hit by new data breach

Afghans express fear for relatives' safety after UK data leak