“Catastrophic” MoD data breach increases risk to safety of Afghans who worked with UK forces 

It is reported that the leaked dataset included personal information of nearly 19,000 people who had previously worked with UK armed forces in Afghanistan and had applied to be relocated, with their families, to the UK as part of the UK Government’s Afghan Relocations and Assistance Policy (ARAP).

The unauthorised disclosure followed an error by an unnamed individual at the MoD in February 2022 but the data breach was only discovered in August 2023 when some details were posted on Facebook. The personal details included people’s names, contact details and, in some cases, family details. 

After becoming aware of the date breach, the MoD then successfully applied to the High Court for an injunction preventing any reporting of the data breach citing the risks posed those affected if the Taliban became aware of the information.  

The Government then established the Afghanistan Response Route (ARR) in April 2024 for those who had not previously been found eligible for ARAP but were judged to be potentially at the highest risk of reprisals by the Taliban as a result of the data incident.

At the High Court on Tuesday 15 July 2025, the injunction was lifted by a judge after reviewing a report by a retired civil servant, commissioned by the MoD, that concluded that the Taliban “likely already possess the key information in the dataset” and that it was “unlikely that individuals would be targeted simply because of their work for the UK”. However the report also stated that “Given the available evidence and the widespread human rights violations, it is not possible to conclude decisively that those individuals affected by the data incident would not face any additional threat, if the dataset were acquired by the Taliban or more widely known publicly in Afghan communities.” 

Furthermore, there are ongoing press reports that the Taliban continue to imprison, torture and kill those suspected of previously assisting international forces. 

Defence Secretary John Healey offered a “sincere apology on behalf of the British government” for the data breach. 

The ARAP scheme was launched by the UK government in April 2021, following the withdrawal of UK forces from Afghanistan. It aimed to provide relocation and support to Afghan nationals who had worked alongside UK armed forces, particularly those whose lives were at risk due to their service. The scheme offered a pathway to resettlement in the UK for these individuals and their immediate families. It closed to new applications earlier this month.

In September 2021, the ARAP scheme faced another data breach when the Ministry of Defence sent an email to over 250 Afghan interpreters which shared the email addresses, names and some associated profile pictures of all other recipients. Leigh Day is also representing a number of clients affected by that data breach.

Leigh Day human rights lawyer Erin Alcock, who has assisted hundreds of ARAP applicants and family members, said: 

“The news today is extremely concerning. We have been aware of rumours circulating of an incident of this kind for some time and have been concerned about any potential risks posed to our clients, particularly those remaining in Afghanistan.

“Sadly, this incident represents a catastrophic failure by the Government to protect the personal information, and therefore the safety, of what is an extremely vulnerable group of individuals. We will be urgently seeking clarification as to which of our many clients may have been affected and confirmation that all necessary precautions have and will be taken to mitigate any risk of harm to them.”

Sean Humber, a specialist data breach lawyer at Leigh Day, who already acts for Afghan citizens affected by previous data breaches of their personal data by the MoD, added: 

“Given the extreme sensitivity of the information and the numbers affected, plus the vulnerability of those affected due to the dangers they already face from the Taliban, this data breach can only be described as catastrophic. Those affected are likely to have strong claims for substantial compensation against the Government for failing to keep the information secure and for inevitable anxiety, fear and distress this has then caused. 

“Unfortunately, this is just the latest in a long line of data breaches by the MoD of personal data of Afghan citizens who had previously worked with UK armed forces. Frankly, the MoD seems institutionally incapable of keeping information secure. There is now an urgent need for a thorough and independent review of the MoD’s whole data processing policies and practises in order to try and prevent yet further breaches. 

”We have been approached by clients who had applied, with their families, for relocation to the UK under the ARAP scheme, who have been contacted by the MoD today to be informed that they were affected by the data breach. Some of these client remain in Afghanistan and understandably they are now extremely concerned to find that their personal information has been disclosed without their knowledge or consent. They are particularly concerned at the risks posed by their personal information now being in the hands of the Taliban, who continue to imprison, torture and kill those suspected of previously assisting international forces, as well as the risks of fraud and identity theft.”

Anybody affected by this data breach who wishes to discuss the matter on a confidential basis, without obligation, should contact Sean Humber on 00 44 (0)20 7650 1308 or by emailing ARAPdatabreach@leighday.co.uk .