A UK parliamentary inquiry has determined that a data breach exposing the personal information of tens of thousands of Afghans who sought relocation to Britain was a foreseeable and systemic failure by the Ministry of Defence (MoD). The breach has raised serious concerns about the protection of vulnerable individuals who had worked with British forces prior to the Taliban’s return to power.
The incident occurred in February 2022 when a British soldier inadvertently sent an Excel file containing the personal details of approximately 25,000 Afghan applicants to a third party outside government. While the file was believed to include information on about 150 applicants, it also held hidden data on more than 18,500 others, which significantly expanded the scope of the breach. These disclosures put the individuals named at risk of Taliban reprisals.
The House of Commons Defence Committee described the data leak as part of a wider failure in governance, accountability, and data security within the MoD, particularly criticizing the use of Excel spreadsheets for handling large volumes of sensitive information without adequate safeguards. The report stated that the system lacked the necessary tools, controls, training, and assurances appropriate to such sensitive handling.
Further criticism was directed at the department’s response, including the secrecy surrounding the incident. Despite the breach occurring in early 2022, it was not discovered until 18 months later in August 2023. Following the discovery, a super-injunction was imposed, preventing media coverage until it was lifted two years later in July 2025. MPs argued this secrecy impeded parliamentary and press oversight and delayed support for those affected.
The Defence Committee also noted that the unit managing Afghan relocations reported 18 additional personal data incidents in the 21 months after the main breach and faced scrutiny for a separate data breach in 2021. The inquiry found accountability within the MoD to be weak and responses fragmented, leaving many vulnerable Afghans without clear information or assistance.
In response, the MoD has stated it has implemented reforms aimed at enhancing data protection standards, emphasizing the safe relocation of thousands of eligible Afghans who have already arrived in the UK. The department reaffirmed its commitment to complete the Afghan Resettlement Programme by the end of the current parliamentary term.
The inquiry also highlighted concerns about a government policy announced in April requiring applicants to attend visa centres in third countries for processing. Labour MP Tan Dhesi, chair of the Defence Committee, warned this could exclude eligible Afghans unable to travel safely or affordably to these locations.
In December 2025, around 1,000 individuals affected by the data breach initiated legal action against the MoD. The relocation efforts for those still at risk continue amid ongoing scrutiny of the department’s handling of the situation and calls for improved transparency and safeguards to protect vulnerable allies.