UK Government’s Afghan Data Breach Exposes Thousands to Taliban Risk
In February 2022, a UK defence official accidentally leaked a spreadsheet containing the personal details of over 33,000 Afghans who had applied for resettlement under British schemes, including the Afghan Relocations and Assistance Policy (ARAP) and the Afghan Citizens Resettlement Scheme (ACRS). The exposed data names, contact details, and family information placed individuals at severe risk of Taliban reprisals, yet the government only became aware of the breach in August 2023 when portions of the data surfaced online.
To suppress the leak, the UK obtained an unprecedented "super-injunction" in September 2023, barring reporting on the breach and even the existence of the court order itself. The injunction, granted contra mundum (binding on all parties), was the first of its kind, preventing public disclosure and leaving affected Afghans unaware of their exposure. Meanwhile, ministers secretly established the Afghanistan Response Route, a covert relocation scheme to evacuate those at risk, without informing Parliament or the media.
The restrictions were lifted on 15 July 2025, revealing the full scale of the breach. By then, the government had resettled 35,700 Afghans across its schemes, but thousands remained stranded. In April 2026, the UK announced it would end in-country assistance for evacuations, requiring eligible Afghans to reach a third country independently before their cases could be processed, with a final deadline of December 2028.
Critics, including advocates like Shamim Saraby, condemned the delays, with some applicants waiting years for decisions. Farhad, an Afghan interpreter whose details were exposed, was resettled in the UK in 2024, but his brother’s application was rejected, leaving him in Afghanistan. Farhad described feeling "betrayed" by broken promises of protection.
In December 2024, Defence Secretary John Healey issued a public apology, acknowledging the lack of transparency. A cross-party inquiry by the Commons Defence Committee is now investigating the breach and the government’s response. The incident has raised concerns about the UK’s handling of sensitive data and its obligations to those who aided British forces.
Source: https://www.bbc.com/news/articles/c0r2r4wnxero
UK government cybersecurity rating report: https://www.rankiteo.com/company/uk-government
"id": "UK-1780820727",
"linkid": "uk-government",
"type": "Breach",
"date": "2/2022",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '33,000+ Afghan applicants for '
'resettlement',
'industry': 'Defence/Public Sector',
'location': 'United Kingdom',
'name': 'UK Government (Ministry of Defence)',
'size': 'Large',
'type': 'Government'}],
'attack_vector': 'Accidental Disclosure',
'data_breach': {'data_exfiltration': 'Data surfaced online (August 2023)',
'file_types_exposed': 'Spreadsheet',
'number_of_records_exposed': '33,000+',
'personally_identifiable_information': ['Names',
'Contact Details',
'Family Information'],
'sensitivity_of_data': 'High (risk of Taliban reprisals)',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Family Information']},
'date_detected': '2023-08-01',
'date_publicly_disclosed': '2025-07-15',
'description': 'In February 2022, a UK defence official accidentally leaked a '
'spreadsheet containing the personal details of over 33,000 '
'Afghans who had applied for resettlement under British '
'schemes, including the Afghan Relocations and Assistance '
'Policy (ARAP) and the Afghan Citizens Resettlement Scheme '
'(ACRS). The exposed data included names, contact details, and '
'family information, placing individuals at severe risk of '
'Taliban reprisals. The government only became aware of the '
'breach in August 2023 when portions of the data surfaced '
"online. The UK obtained a 'super-injunction' in September "
'2023 to suppress reporting, which was lifted in July 2025.',
'impact': {'brand_reputation_impact': "Severe damage to UK government's "
'reputation, particularly regarding '
'data protection and obligations to '
'Afghan allies',
'data_compromised': 'Personal details (names, contact details, '
'family information) of over 33,000 Afghans',
'identity_theft_risk': 'High risk of Taliban reprisals against '
'exposed individuals',
'legal_liabilities': 'Potential legal actions from affected '
'individuals; cross-party inquiry by Commons '
'Defence Committee',
'operational_impact': 'Covert relocation operations initiated; '
'delayed processing of resettlement '
'applications'},
'investigation_status': 'Ongoing (cross-party inquiry by Commons Defence '
'Committee)',
'lessons_learned': 'Need for improved data handling procedures for sensitive '
'information; importance of timely disclosure and '
'transparency; challenges of protecting high-risk '
'individuals in conflict zones',
'post_incident_analysis': {'corrective_actions': 'Establishment of covert '
'relocation scheme; review '
'of data handling '
'procedures; public inquiry '
'into the breach',
'root_causes': 'Human error (accidental disclosure '
'of spreadsheet); inadequate data '
'protection measures for sensitive '
'resettlement data'},
'recommendations': ['Strengthen data protection protocols for sensitive '
'resettlement programs',
'Improve incident response timelines and transparency',
'Ensure timely communication with affected individuals',
'Review legal frameworks for handling data breaches '
'involving national security risks'],
'references': [{'source': 'Original Incident Report'}],
'regulatory_compliance': {'legal_actions': 'Cross-party inquiry by Commons '
'Defence Committee',
'regulations_violated': ['Data Protection Laws '
'(potential GDPR '
'violations)']},
'response': {'communication_strategy': 'Delayed public disclosure until July '
'2025; public apology issued in '
'December 2024',
'containment_measures': "Obtained a 'super-injunction' to "
'suppress reporting; established covert '
'relocation scheme (Afghanistan Response '
'Route)',
'remediation_measures': 'Resettled 35,700 Afghans; ended '
'in-country assistance for evacuations '
'(April 2026)'},
'stakeholder_advisories': 'Public apology issued by Defence Secretary John '
'Healey (December 2024)',
'title': 'UK Government’s Afghan Data Breach Exposes Thousands to Taliban '
'Risk',
'type': 'Data Breach',
'vulnerability_exploited': 'Human Error'}