UK Ministry of Defence Data Breach Exposed Thousands of At-Risk Afghans, Report Finds
A damning investigation by the UK’s defence select committee has revealed systemic failures in the Ministry of Defence’s (MoD) handling of a 2022 data breach that exposed the personal details of 18,700 Afghans who had assisted UK forces and were seeking evacuation. The report, released following a parliamentary inquiry, condemned the government for preventable errors, excessive secrecy, and inadequate support for affected individuals.
The breach occurred in February 2022 when an MoD employee inadvertently shared an Excel file containing a hidden tab with sensitive data believing it held only 150 records. The leak, which the committee deemed a “foreseeable failure,” could have been avoided with basic training on spreadsheet security. By the time the MoD acknowledged the incident in August 2023, thousands had already been aware of the exposure.
In response, the government imposed an unprecedented superinjunction a court order banning even the mention of its existence against media outlets, including The Independent. The secrecy delayed evacuations and denied affected Afghans the chance to protect themselves, while the covert relocation effort reportedly cost billions. The committee criticized the government for prioritizing operational secrecy over accountability, leaving vulnerable families without critical information.
As of June 2026, approximately 7,000 eligible Afghans remain stranded, with 3,700 still in Taliban-controlled Afghanistan. In April, the MoD introduced a “self-move” policy, requiring approved families to fund their own escape to a third country for UK entry clearance a shift MPs called a “two-tier system” that excludes the most vulnerable. The committee demanded annual risk assessments for Afghan applicants and a clear plan to assist those unable to evacuate independently.
The report also highlighted a lack of accountability within the civil service, with no clear responsibility assigned for data protection risks before the breach. Independent caseworkers and advocacy groups, including the Sulha Alliance, warned of the severe human cost, from physical threats to psychological trauma, and urged the government to reinstate third-party support for evacuations.
An MoD spokesperson acknowledged the breach’s impact, stating that thousands have been relocated but pledged to conclude the resettlement program by the end of the current parliament. Reforms, including improved data protection and casework processes, have since been implemented. However, the committee’s findings underscore persistent gaps in transparency and support for those the UK had pledged to protect.
UK Ministry of Defence TPRM report: https://www.rankiteo.com/company/uk-ministry-of-defence
"id": "uk-1785371161",
"linkid": "uk-ministry-of-defence",
"type": "Breach",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '18,700 Afghans (and their '
'families) who assisted UK '
'forces',
'industry': 'Defence',
'location': 'United Kingdom',
'name': 'UK Ministry of Defence (MoD)',
'size': 'Large',
'type': 'Government Agency'}],
'attack_vector': 'Human Error (Inadvertent Data Exposure)',
'customer_advisories': 'Affected individuals were not promptly informed due '
'to secrecy measures',
'data_breach': {'file_types_exposed': 'Excel file with hidden tab',
'number_of_records_exposed': '18,700',
'personally_identifiable_information': 'Yes (names, contact '
'details, and other '
'sensitive '
'information)',
'sensitivity_of_data': 'High (details of individuals who '
'assisted UK forces, at risk of '
'Taliban retaliation)',
'type_of_data_compromised': 'Personally identifiable '
'information (PII) of at-risk '
'individuals'},
'date_detected': '2022-02',
'date_publicly_disclosed': '2023-08',
'description': 'A damning investigation by the UK’s defence select committee '
'revealed systemic failures in the Ministry of Defence’s (MoD) '
'handling of a 2022 data breach that exposed the personal '
'details of 18,700 Afghans who had assisted UK forces and were '
'seeking evacuation. The breach occurred when an MoD employee '
'inadvertently shared an Excel file containing a hidden tab '
'with sensitive data. The government imposed a superinjunction '
'to suppress media coverage, delaying evacuations and leaving '
'vulnerable families without critical information.',
'impact': {'brand_reputation_impact': "Severe damage to UK government's "
'credibility, criticism for secrecy and '
'mismanagement',
'data_compromised': 'Personal details of 18,700 Afghans',
'financial_loss': 'Billions (reportedly spent on covert relocation '
'efforts)',
'identity_theft_risk': 'High (exposure of personally identifiable '
'information)',
'legal_liabilities': 'Potential regulatory violations, '
'superinjunction imposed',
'operational_impact': 'Delayed evacuations, hindered protection '
'efforts for at-risk individuals'},
'investigation_status': 'Completed (parliamentary inquiry)',
'lessons_learned': 'Need for basic spreadsheet security training, improved '
'data protection measures, clearer accountability for data '
'risks, and better support for affected individuals. '
'Secrecy and delayed responses exacerbated the crisis.',
'post_incident_analysis': {'corrective_actions': ['Reforms in data protection '
'and casework processes',
'Introduction of annual '
'risk assessments',
'Improved training on data '
'handling'],
'root_causes': ['Lack of basic spreadsheet '
'security training',
'Hidden data in Excel files',
'Inadequate data protection '
'protocols',
'Delayed incident response and '
'secrecy']},
'recommendations': ['Conduct annual risk assessments for Afghan applicants',
'Develop a clear plan to assist those unable to evacuate '
'independently',
'Reinstate third-party support for evacuations',
'Improve transparency and communication strategies',
'Enhance data protection training and protocols'],
'references': [{'source': 'UK Defence Select Committee Report'},
{'source': 'The Independent'}],
'regulatory_compliance': {'legal_actions': 'Superinjunction imposed against '
'media outlets',
'regulations_violated': 'Potential violations of '
'data protection '
'regulations (e.g., UK '
'GDPR)'},
'response': {'communication_strategy': 'Delayed and secretive, criticized for '
'lack of transparency',
'containment_measures': 'Superinjunction imposed to suppress '
'media coverage',
'recovery_measures': "Introduction of 'self-move' policy for "
'evacuations, annual risk assessments for '
'Afghan applicants',
'remediation_measures': 'Covert relocation efforts, reforms in '
'data protection and casework processes',
'third_party_assistance': 'Independent caseworkers and advocacy '
'groups (e.g., Sulha Alliance)'},
'stakeholder_advisories': 'Government urged to address gaps in transparency '
'and support for affected Afghans',
'title': 'UK Ministry of Defence Data Breach Exposed Thousands of At-Risk '
'Afghans',
'type': 'Data Breach',
'vulnerability_exploited': 'Lack of spreadsheet security training, hidden '
'data in Excel files'}