In February 2022, a significant data breach at the UK’s Ministry of Defence (MoD) exposed the personal details of 18,700 Afghan nationals who had applied for relocation to the United Kingdom. This breach, caused by an MoD official inadvertently emailing a spreadsheet containing sensitive information outside authorized government systems, put these individuals at heightened risk of retaliation from the Taliban. (theguardian.com)
In response to the breach, the MoD established the Afghanistan Response Route (ARR) to facilitate the resettlement of those directly affected. By July 2025, the MoD estimated that 7,355 individuals, including 1,531 principal applicants and their family members, would be resettled in the UK through the ARR as a direct consequence of the data leak. (nao.org.uk)
However, the National Audit Office (NAO) has raised concerns about the accuracy of the MoD’s cost estimates for the resettlement scheme. The MoD projected a total cost of £850 million for resettling individuals through the ARR, not including legal costs or compensation claims. Yet, the NAO found that the MoD could not provide sufficient evidence to support this estimate, as the department did not separately identify these costs in its accounting system. (nao.org.uk)
The NAO’s report also highlighted that the MoD’s poor management of personal information had placed the lives of many thousands of Afghans at risk. The Public Accounts Committee criticized the department for a “farrago of errors” in handling the data breach, noting that the MoD had not given sufficient assurance over the reported costs and had failed to implement adequate measures to prevent further data breaches. (ein.org.uk)
This incident underscores the critical importance of safeguarding sensitive information, especially when it pertains to vulnerable populations. The MoD’s failure to protect personal data not only jeopardized the safety of Afghan nationals but also led to significant financial implications for the UK government. As the resettlement scheme continues, it is imperative that the MoD implements robust data protection measures to prevent future breaches and ensure the safety of those it aims to protect.
References: