How data leak compromised nearly 19,000 Afghans leading to their relocation by the UK

First Post

16-07-2025

A massive 2022 data breach exposed personal details of nearly 19,000 Afghans linked to British forces, prompting a covert UK scheme to relocate thousands under Taliban threat. Hidden behind a superinjunction for nearly two years, the secret evacuation cost billions read more
British Forces from 16 Air Assault Brigade arrive in Kabul, Afghanistan, to provide support to British nationals leaving the country, as part of Operation PITTING after Taliban took control of the presidential palace in Kabul, August 15, 2021. File Image/UK Ministry of Defence via Reuters
A serious data leak by a British defence official in 2022 triggered one of the most secretive and expensive relocation efforts in recent UK history.
The breach exposed the personal information of nearly 19,000 Afghan nationals and their families who had applied for protection under the Afghan Relocations and Assistance Policy (ARAP), a programme created to support those who had worked with British forces during the UK's military presence in Afghanistan.
The error ultimately led to the covert resettlement of thousands of Afghans, cost London billions of pounds, and resulted in an unprecedented legal battle to suppress details from the public for nearly two years.
STORY CONTINUES BELOW THIS AD
The breach, which occurred in February 2022, involved a defence official working outside authorised government systems. The individual mistakenly sent a full list of ARAP applicants to an unintended recipient while attempting to contact just 150 people.
That list, which included names, phone numbers, addresses, and even some UK government email contacts, ultimately reached individuals in Afghanistan.
One recipient later threatened in a Facebook group to post the entire database online.
It was only in August 2023 that the UK Ministry of Defence (MoD) became aware of the leak's scale, after part of the data surfaced on Facebook.
The breach raised alarm in Whitehall, given the real possibility that the Taliban — who had returned to power in Afghanistan in August 2021 — could gain access to the list and target those named on it for reprisals.
How did the UK govt respond?
The severity of the incident prompted then-UK Defence Secretary Ben Wallace to seek extraordinary legal protections. On September 1, 2023, the High Court granted what is believed to be the first superinjunction ever requested by a UK government.
The order prohibited not only the reporting of the data breach but also any mention of the injunction's existence. It was issued 'against the world,' meaning it applied to all individuals, not just specific parties.
This move was criticised by several media organisations, but the courts repeatedly upheld the injunction.
One High Court judge, while extending the order in February 2024, acknowledged the lack of parliamentary or media scrutiny but accepted the government's argument that disclosure could endanger lives if the Taliban learned of the list.
STORY CONTINUES BELOW THIS AD
Wallace later defended the government's handling of the situation. Writing in The Telegraph, he stated, 'Some may disagree but imagine if the Taliban had been alerted to the existence of this list. I would dread to think what would have happened.'
He insisted that the decision to suppress the story was not a cover-up but an effort to prioritise the safety of those exposed.
What is Operation Rubific?
Immediately after learning of the leak's extent in August 2023, the MoD launched an urgent internal investigation and began tracing the spread of the data.
At the same time, UK officials contacted around 1,800 ARAP applicants who were in Pakistan at the time, warning them of the potential threat to their safety.
Facebook was also contacted and asked to remove the relevant post due to the 'risk of physical harm' to those named.
In response to the escalating threat, the UK quietly initiated Operation Rubific, a classified effort aimed at extracting Afghans judged to be at highest risk.
In December 2023, this was formalised into a secret scheme known as the Afghanistan Response Route (ARR).
It was designed specifically to assist individuals affected by the breach who were not eligible under ARAP but whose exposure made them vulnerable to Taliban retaliation.
STORY CONTINUES BELOW THIS AD
Although the ARR initially aimed to help approximately 200 principal applicants and their families, the numbers quickly grew.
By July 2024, the scheme had relocated 900 individuals and 3,600 family members.
An additional 600 people who had been issued relocation invitations would also be accommodated, UK Defence Secretary John Healey confirmed in Parliament.
What did it cost?
Including those relocated through the ARR and other existing schemes, the number of Afghans brought to the UK due to the breach reached more than 16,000 by mid-2025.
Overall, the government has resettled more than 56,000 people across various Afghan evacuation and relocation programmes since 2021.
The financial implications were equally significant. The ARR alone is projected to cost £850 million, while the broader cost of relocation efforts across all schemes — including existing ARAP applicants — has been estimated between £5.5 billion and £6 billion.
According to an unnamed official cited in early reports, the data breach itself may have cost around £2 billion.
Healey, speaking in Parliament confirmed that the official responsible for the data leak was 'no longer doing the same job.'
He offered a 'sincere apology on behalf of the British government,' a sentiment echoed by other political leaders including Conservative ministers Kemi Badenoch and James Cartlidge.
STORY CONTINUES BELOW THIS AD
Were the Afghans at risk from Taliban?
In January, the UK Ministry of Defence commissioned Paul Rimmer, a former senior civil servant, to conduct an independent review of the situation.
The assessment concluded that while killings and detentions still occur in Afghanistan, there was no clear evidence that the Taliban had obtained the dataset.
The report found 'little evidence of intent by the Taliban to conduct a campaign of retribution' based on the breach and noted that the leaked data 'may not have spread nearly as widely as initially feared.'
It also questioned the proportionality of the continued ARR scheme, suggesting that the threat may no longer justify its operation.
'The ARR scheme may now be disproportionate to the actual impact of the data loss,' the report noted.
Based on these findings, the MoD petitioned the High Court to lift the superinjunction on Tuesday.
The ARR scheme was officially closed shortly thereafter.
However, the 600 relocation offers previously extended to individuals and their families will still be honoured.
Healey reiterated in Parliament, 'When this nation makes a promise, we should keep it.'
Also Watch:
With inputs from agencies