Defence Committee report exposes failures by Ministry of Defence to keep Afghans’ personal data secure and strengthens claims for compensation

A parliamentary inquiry found the breach was a “foreseeable” failure in a system that left people who had worked with UK troops in danger for years.

The catastrophic data breach happened in February 2022 when the personal details of Afghans who had previously worked with the UK armed forces in Afghanistan and had applied to be relocated to the UK with their families were disclosed in error to a third party. 

The personal details included people’s names, contact details and, in some cases, family details, with the breach occurring six months after the fall of Kabul to the Taliban.

The data breach was only discovered in August 2023 when some of these personal details were posted on Facebook.

It has since been found that the breach was one of 19 “data security incidents” between February 2022 and November 2023, and was caused by a member of MoD personnel sharing an Excel spreadsheet with a “trusted third party”.

After becoming aware of the data breach, the MoD obtained a super-injunction from the High Court preventing any reporting of the data breach, citing the risks posed to those affected if the Taliban became aware of the information. The super-injunction was only lifted in July 2025.

Following a lengthy investigation into the circumstances of the data breach and its consequences, the House of Commons Defence Select Committee have today produced a highly critical report cataloguing the MoD’s multiple failures to keep the personal information secure. The committee concluded:

“The breach was not simply an individual mistake, but a foreseeable systemic failure. It arose from the combination of inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability. The pressures of the fall of Kabul in 2021 help to explain how these weaknesses developed; they do not excuse their continuation into 2022. The MOD handled sensitive immigration casework using tools and controls not appropriate for a life-endangering dataset at any scale. Controls have improved since, but the episode shows the risk of taking on unfamiliar responsibilities without fit-for-purpose systems, assurance and clear accountability”

The committee was also highly critical of the manner in which the MoD eventually informed those affected of the data breach in July 2025 and failure to offer the necessary guidance and support. The committee also concluded:

“The government approached notification of affected Afghans primarily as a communications exercise rather than as a safeguarding intervention. Although the notification reached most affected individuals, it did not provide sufficiently specific, actionable or individualised information to enable people to understand their level of risk, what data relating to them or their families had been compromised, or what practical steps they could take. Nor was it supported by an adequate system of follow-up engagement, case-specific advice or assistance. Given the time available to plan for disclosure and the foreseeable reaction of people receiving notice of a potential risk-to-life data breach - many of whom were in Afghanistan or precarious third-country settings - the government should have treated notification as an immediate operational response to safeguarding need, not simply as public messaging.”

Sean Humber, a specialist data breach human rights lawyer at Leigh Day, who currently acts for more than 250 Afghan citizens affected by the data breach, stated:

“Today’s House of Commons Defence Select Committee’s damning report reveals in excruciating detail the manifold failures of the Ministry of Defence to keep our clients’ highly sensitive personal information safe. This report further strengthens claims by those affected against the Government for substantial compensation for failing to keep their personal information secure and the anxiety, fear and distress, as well as any other losses, that this has then caused.

“The Ministry of Defence must now unambiguously accept legal responsibility for the consequences of their errors and commit to working with those affected and their legal advisers to establish a scheme that justly compensates those affected for the anxiety and distress, and any other losses, suffered as a result of the data breach.”

If you were affected by the data breach and wish further information in relation to joining over 6,500 people in bringing a claim for compensation, please click here.