Afghan data breach: What we do and do not know

BBC News

16-07-2025

A major data breach which led to thousands of Afghans being secretly relocated to the UK became public knowledge for the first time this week.On Tuesday, the High Court ruled it was time for the details to see the light of day - but the revelations have raised as many questions as they answered.
What data was leaked and how was it discovered?
A spreadsheet containing the personal details of almost 19,000 people who had asked to come to the UK in order to flee the Taliban was accidentally leaked by an official working at the Ministry of Defence in February 2022.That unnamed official emailed the document outside of the government team processing Afghan relocation applications and it made its way into the public domain. The police decided no investigation was needed - but we do not know if that official is still employed by the government. The leaked document contained the names, contact details and, in some cases, family information of a huge number of people who believed their association with British forces during the Afghanistan war could leave them at risk of harm.The leak only came to light in August 2023, when the names of nine people who had applied to move to the UK on Facebook.The government realised the list was out there and, fearing it could fall into the hands of the Taliban, sought to supress any knowledge of it by getting a court injunction.
How many people were relocated after the breach?
In September 2023, it was feared as many as 100,000 could be impacted by the leak, when taking into account family members.In April 2024, the government covertly set up the Afghanistan Response Route (ARR) for people whose details were included to offer them a way out of Afghanistan - but they were not told about the leak.This new, secret route was separate from the main Afghan Relocations and Assistance Policy (Arap) scheme.By May 2024, the court had seen evidence that around 20,000 people could be eligible for relocation under the new scheme.Defence Secretary John Healey said on Tuesday that around 900 people are already in the UK or are on their way, along with 3,600 of their family members.A further 600 offers having been made, though he did not specify whether that included those people's families.We do not know how many people who were on the leaked list are still in Afghanistan.In total, around 36,000 Afghans have moved to the UK since the withdrawal of international troops. Both the ARR and Arap schemes are now closed.
Did anyone die as a result of the leak?
It is not possible to say definitively whether anyone came to harm as a direct result of the leak, and the MoD has refused to be drawn on this matter.However, a review carried out for the government in early 2025 by retired civil servant Paul Rimmer found the leaked document "may not have spread nearly as widely as initially feared", and cast doubt on previous assessments that the information would have been of great value to the Taliban.Mr Rimmer concluded that, given the Taliban already has access to masses of data about the population of Afghanistan, it was "unlikely" it would have been the sole reason for a reprisal attack.He said while killings and human rights abuses against former officials are carried out, concern about a widespread retribution campaign had "diminished".But those included in the leaked document consider it a catastrophic failure which has increased the risk to them and their families.
What was the financial cost of the secret relocation plan?
The government has spent £400m on the scheme so far and anticipates spending a further £450m.That is far below estimates heard in secret in the High Court in May 2024, which said it could cost "several billions".In total, the eventual cost of all efforts to relocate Afghans since 2021 will be around £5.5-£6bn, the government has said.
What is a super-injunction and why was one put in place?
Then-Defence Secretary Ben Wallace made an application to the High Court on 1 September 2023, seeking an injunction which would criminalise making the leak public.The Taliban could seek out the list and use it to target people, the government feared.Mr Justice Knowles said the request was "exceptional" and went "further" than the government had asked, upgrading it to a super-injunction. This made it illegal to both reveal details of the leak and refer to the existence of the court order and.It was regularly reviewed by another judge, Mr Justice Chamberlain, who in November 2023 said it was the first injunction of its kind and raised freedom of speech concerns.He sought to lift the order the following May but the government appealed and it remained before being lifted on Tuesday.Another injunction was granted to prevent some of the most sensitive details in the leaked document being made public.
Who knew what in government, and when?
From August 2023, efforts were made to restrict the number of officials within the MoD who knew about the leak, and it is unclear when then-Prime Minister Rishi Sunak and other cabinet ministers were made aware.In December 2023, Healey - who was then shadow defence secretary - was briefed on the leak by then-Armed Forces Minister James Heapey.Healey said the shadow cabinet more widely was not told until after the general election.At no point were MPs made aware of the leak, which has led to questions about the ability of the Commons to scrutinise the matter.BBC News understands that Labour ministers decided last Autumn that they needed to look at whether to lift the super-injunction.Hearings were held in November 2024 and a senior MoD source told BBC News the government's position at that time was that the super-injunction should be kept in place "pending further work".But the source said ministers had privately agreed that a review looking at the possibility of ending the super-injunction was needed.By the time the super-injunction was lifted, seven media organisations had become aware of the leak and had been blocked from publishing details.
Additional reporting by Jack Fenwick