Following a data leak, thousands of Afghans were relocated to the UK under a covert plan

Thousands of Afghans have been quietly resettled in the UK under a covert scheme triggered by a significant data leak involving nearly 19,000 applicants to a British relocation programme, newly unsealed court documents reveal.

The breach occurred in February 2022, when a Ministry of Defence (MoD) official accidentally sent a spreadsheet containing names, contact details, and family information of Afghan nationals eligible under the UK’s Afghan Relocations and Assistance Policy (Arap). These individuals were considered at risk following the Taliban’s return to power in 2021.

Only in August 2023, when information from the leak appeared in a Facebook group, did the incident's seriousness become apparent. The UK government responded by launching a confidential relocation programme — the Afghan Relocation Route — nine months later. To date, this initiative has brought 4,500 Afghans to the UK.

However, the public and even members of Parliament remained unaware of the leak and subsequent relocations due to a super-injunction granted by the High Court. This legal order not only barred media outlets from reporting on the breach but also prohibited them from acknowledging the injunction’s existence. On Tuesday, the order was lifted following a court ruling citing concerns over democratic accountability and press freedom.

Defence Secretary John Healey delivered a formal apology in the House of Commons, calling the incident a “serious departmental error.” He explained that the breach stemmed from a spreadsheet being shared outside authorised systems and confirmed that those affected had only just been notified and advised to take precautions, such as monitoring their online security.

Healey also revealed that the breach had exposed the identities of senior military figures, MPs, and government officials. While the MoD maintains that the breach was unintentional and posed limited risk, a High Court judge acknowledged the potential danger, noting it was “quite possible” that members of the Facebook group where the data appeared were affiliated with or sympathetic to the Taliban.

Although early estimates feared up to 100,000 people might face death or harm due to the breach, an MoD review concluded that it was “highly unlikely” anyone was specifically targeted as a result. Nevertheless, the UK government confirmed that 600 Afghan soldiers and 1,800 of their relatives still remain in Afghanistan, awaiting relocation under the now-closing programme.

The operation, funded by British taxpayers, has already cost £400 million and is expected to require another £400–450 million. The government has committed to honouring all relocation offers already made, despite the scheme's winding down.

The identity of the MoD official responsible for the breach has not been disclosed, and Downing Street has refused to say whether disciplinary action has been taken.

Former Defence Secretary Ben Wallace personally sought the super-injunction to allow time for the government to respond to the crisis and protect those at risk. The gag order was later extended amid concerns the Taliban might be unaware of the breach. However, Mr Justice Chamberlain ultimately ruled that the Taliban likely already knew about the data and that continued secrecy served no further purpose.

Shadow Defence Secretary James Cartlidge condemned the data leak as a violation of data protection protocols, while Erin Alcock, a lawyer from Leigh Day assisting hundreds of Arap applicants, described it as a “catastrophic failure.”

A 2022 Foreign Affairs Committee report called the initial operation a "disaster" and a "betrayal," adding to the growing condemnation of the UK's Afghan evacuation attempts.

The administration acknowledged earlier this month that it had started paying out compensation to some Afghans who had been impacted by a different data hack.