Afghan data breach was a ‘foreseeable failure’ covered up by secrecy for too long, damning report into MoD blunder finds

A devastating Ministry of Defense data breach that exposed the personal information of tens of thousands of Afghans was a “foreseeable failure” that was shrouded in secrecy “for too long”, a damning investigation has concluded.

In a report by the influential defense committee, MPs criticized the government for almost every aspect of its handling of the data breach; the resulting injunction (a court order so strict that it was forbidden to even mention its existence) and the secret evacuation of thousands of Afghan families.

They concluded that “secrecy was maintained for too long, accountability was too weak, delivery was too fragmented, and affected Afghans were often left without the information and support they needed.”

The leak in February 2022 revealed details of 18,700 Afghans who said they were in danger from the Taliban due to their links to UK forces and now wanted to flee to the UK.

This mistake led to an unprecedented injunction, including from the national media. Independentand launched a secret evacuation programme, the cost of which is still unclear but is likely to run into billions of pounds.

After the undercover operation was revealed by this outlet and others in July last year, lawmakers launched an investigation to examine what happened. The defense selection committee concluded in its report:

MPs called on the government to publish periodic reassessments of the risks Afghan applicants face to UK resettlement schemes and for authorities to report the findings annually. They also want ministers to publish a clear policy explaining how they will help Afghans who are eligible to come to the UK but have not yet been evacuated.

The defense committee also criticized the lack of accountability in the civil service, calling on the Ministry of Defense to explain who was responsible for the data protection risk before the Afghan breach.

The leak occurred when a member of the Department of Defense staff sent an Excel file outside the government. They thought the data sheet contained details of around 150 Afghan applicants, when in fact there was a hidden tab containing details of more than 18,500 people. The report concluded that the breach “could still have been prevented” if Department of Defense personnel had “received basic training” on the issue.

As of 9 June 2026, there were around 7,000 people left eligible to move to the UK, 3,700 of whom are believed to be in Afghanistan.

In April, the Ministry of Defense told Afghan families who had approved asylum in Britain that they would have to flee the Taliban-ruled country on their own.

This created a “two-tier system” in which those who could raise the necessary funds could relocate, but vulnerable and poor families could not.

MPs said: “The government has not adequately explained how it will protect eligible Afghans who cannot safely, legally or economically self-translate to a third country for UK entry clearance checks. This is a serious gap in the current model.”

Tan Dhesi MP, chairman of the defense committee, said: “The latest ‘self-acting’ policy risks leaving out people the UK has promised to help, including some people who should have been brought here years ago.

“The broader picture is deeply troubling. The DoD should have remained loyal to defense; it should never have been left to carry out immigration casework plans. Secrecy was too easily used as a shield against proper accountability in areas far removed from sensitive operations.”

Person A, an independent caseworker who alerted the government to the data breach in the summer of 2023, called on the government to “immediately reinstate third-party support to approved families attempting to flee Afghanistan.” They added: “It is immoral to make our promise to resettle these families conditional on their ability to obtain large loans in a short period of time.

“We owe these men and women a debt of honor, and it is time to mobilize heaven and earth to keep our promises.”

Professor Sara de Jong, of the Peace Alliance, which supports Afghans working for the British military, welcomed the report’s call to help eligible Afghans who are unable to evacuate themselves.

Speaking about the impact of the data breach, he said: “From what I know from my daily contact with Afghans, these human costs, from physical risk to psychological damage, are much more serious than the government initially acknowledged.”

He also backed MPs’ conclusion that the independent ‘Rimmer’ review into the Afghan data breach should not be the “final word” on whether someone has been put at risk.

It concluded: “The report’s conclusions that the government kept the data breach secret for too long, avoided public scrutiny and accountability to affected Afghans, and that ‘the government’s assumptions about who could be trusted were too pessimistic’ are a vindication for anyone like me, who was long aware of the data breach but exercised discretion in the interests of affected Afghans.”

A Ministry of Defense spokesman said: “This incident should never have happened and we recognize the significant impact it has had on many people.

“Thousands of eligible Afghans have been resettled safely in the UK where they can rebuild their lives, and we are committed to completing the Afghan Resettlement Program by the end of this parliament.

“We are learning lessons from this incident and significant reforms are already in place, including improved data protection standards, strengthened case work processes and better program management.”