Almost 7,000 Afghan nationals are being relocated to the UK following a massive data breach by the British military that the government tried to keep secret with a super injunction, potentially costing taxpayers £7 billion.
The blunder exposed the personal information of close to 20,000 individuals who had helped British forces, endangering them and their families under Taliban rule. Details about the disaster can finally be made public after a judge lifted the super injunction that had been sought by the government.
Barings Law, representing around 1,000 victims, accused the government of attempting to hide the truth from the public following a lengthy legal battle. The government is expected to make a statement to parliament imminently about the security failure.
Email Error Triggered Disaster
The catastrophe was triggered by the careless handling of an email containing a list of names and details of around 20,000 Afghan nationals. The individuals had applied to a British government scheme supporting those who helped or worked with UK forces fighting the Taliban between 2001 and 2021.
The collapse of the western-backed Afghan government in 2021 saw the Taliban return to power. The new regime regards anyone who worked with British or other foreign forces during the previous two decades as a traitor, placing those exposed at grave risk.
A source said a small number of people named on the list are known to have subsequently been killed, though it is not clear if this was a direct result of the data breach. It remains uncertain whether the Taliban has obtained the list – only that the Ministry of Defence lost control of the information.
Legal Action Launched
Adnan Malik, head of data protection at Barings Law, condemned the government’s attempts at secrecy. “This is an incredibly serious data breach, which the Ministry of Defence has repeatedly tried to hide from the British public,” he said.
It involved the loss of personal and identifying information about Afghan nationals who have helped British forces to defeat terrorism and support security and stability in the region. A total of around 20,000 individuals have been affected, putting them and their loved ones at serious risk of violence from opponents and armed groups.”
The law firm is working with around 1,000 of those impacted “to pursue potential legal action” against the Ministry of Defence. The scale of the breach dwarfs previous incidents involving Afghan nationals’ data.
Previous Breaches Revealed
The Information Commissioner’s Office had previously fined the MoD £350,000 in December 2023 for separate, smaller data breaches affecting 265 Afghan nationals in September 2021. In those incidents, email addresses were exposed when staff used the ‘To’ field instead of ‘Blind Copy’ when contacting evacuation candidates.
The ICO described those earlier breaches as “particularly egregious”, noting they “let down those to whom our country owes so much”. That incident prompted criticism that the MoD had failed to report the breach promptly.
This new revelation involves a dataset nearly 80 times larger than the previously known breaches. The exposure of 20,000 individuals’ details represents one of the most serious data protection failures in UK government history.
Cost Estimates Vary
The total cost of the mistake has been estimated at around £7 billion, though the Ministry of Defence is expected to claim the final sum will be significantly lower. The figure would include relocation costs, compensation, legal fees and security measures.
Previous reports suggested a secret Afghan Response Route scheme established in April 2024 had already cost £400 million, with a projected total of £850 million. The new £7 billion estimate suggests the full scale of the breach’s impact is far greater than initially understood.
The government had originally outlined compensation scheme plans costing between £120 million and £350 million, excluding administration expenses. Hundreds of data protection legal challenges are expected, potentially adding millions more in legal costs.
Parliament Statement Expected
The lifting of the super injunction means MPs can finally question ministers about the breach and its handling. Previously, Mr Justice Chamberlain noted it was “fundamentally objectionable” that MPs and peers “cannot ask questions about something they do not know about.”
The judge had ruled in May 2024 that decisions about thousands of lives and “enormous sums of public money” should not be taken in secret. However, the Court of Appeal initially maintained the super injunction, citing security concerns.
The government’s expected parliamentary statement will likely face intense scrutiny over both the data breach itself and the decision to keep it secret from public and parliamentary oversight for so long.
Relocation Programme Impact
The breach has necessitated the relocation of almost 7,000 Afghan nationals to protect them from Taliban reprisals. This represents a significant expansion of existing resettlement schemes at a time when acceptance rates for Afghan applications have plummeted.
Recent figures show only 73 out of 17,625 Afghan Relocations and Assistance Policy applications were approved in the first half of 2025 – just 2.04 per cent. This represents a further decline from the already low 5.3 per cent acceptance rate in 2024.
The forced relocation of thousands due to the data breach stands in stark contrast to the stringent restrictions on those applying through official channels. Critics argue this highlights the devastating consequences of the MoD’s security failures.
The revelation is likely to prompt urgent questions about data security protocols within the Ministry of Defence and across government departments handling sensitive personal information of vulnerable individuals.
Follow for more updates on Britannia Daily
Ministry of Defence – Image by David Dixon, licensed under CC BY-SA 2.0, via Wikimedia Commons.
View Image
