Afghans at risk of fresh data breach scandal because MoD still hasn’t fixed security flaws
A devastating Ministry of Defense (MoD) data breach that exposed details of thousands of Afghans seeking asylum in the UK and potentially put up to 100,000 lives at risk could happen again, MPs have warned.
A cross-party group of MPs examining government spending published a damning report into the MoD’s response to the breach on Friday.
The public accounts committee (PAC) found that the department had failed to learn from multiple data breaches in successive years and that the Ministry of Defense had inadequate systems and controls to manage personal data.
The February 2022 breach occurred when a spreadsheet containing 33,000 lines of data was emailed to someone outside the government. It was only discovered in August 2023, when parts of the database appeared in a Facebook group. This led the government to issue an unprecedented injunction to halt reporting and triggered a massive secret evacuation program.
For about two years, including media organizations IndependentHe sought to examine the Defense Department’s actions in secret court hearings. The PAC report reveals the Ministry of Defense failed to tell the National Audit Office (NAO) what had happened, despite promising billions of pounds of taxpayer money for a secret evacuation plan behind closed doors.
The report said an audit director at NAO was told by the Department of Defense that the data breach was a confidential matter that could not be shared. They were not given any details about the operational results, the number of people affected, or the potential cost. The director was also told that they could not pass this information on to anyone else within the spending watchdog.
At one point in October 2024, ministers signed off on a £7bn plan to move around 36,000 people to the UK, a significant majority of whom were affected by the data breach.
Commenting on the failures that led to the data breach, PAC chairman Sir Geoffrey Clifton-Brown said: “The MoD knew what it was doing; it knew the risks of using inadequate systems to handle sensitive personal information as the security environment in Afghanistan deteriorated.”
He continued: “We have no confidence in the MoD’s current ability to prevent such an incident from happening again.”
Sir Geoffrey said: “The frankly chaotic decision to tell a single director within the NAO that there was a confidential matter that could not be shared without informing the leadership of the NAO is emblematic of the quality of decision-making in the Ministry of Defence.
“The MoD’s outgoing permanent secretary told our inquiry that this period of secrecy about how taxpayers’ money is being spent was ‘deeply troubling’ to him. This is exactly as it should be, and we are pleased to hear it – but as a result of elected representatives being prevented from holding the government to account, it is not nearly enough and he should never have been put in such a position by his minister.”
An independent caseworker who first alerted the government to data loss in 2023 said the committee’s report was “threatening”.
“This demonstrates a sustained prioritization that continues to limit DoD accountability when it comes to the 2022 data breach. Thousands of people remain in danger in Afghanistan, but the evacuation route is now at a standstill,” they said.
“The MoD notes that they face significant challenges to resettlement, which means Afghans who have risked their lives for the UK face living in hiding for a fifth year, waiting to see whether the UK will finally deliver on our promise to move heaven and earth to get them out.
“It is clear that the committee is concerned that further breaches may occur, a concern I share, as lessons do not appear to have been learned.”
According to the latest research from Lighthouse Reports, more than 100 former Afghan forces have been killed in the country since 2023, and Afghan security forces are still being captured, tortured and executed by the Taliban. Independent to create.
A Ministry of Defense spokesperson said: “The data incident in 2022 under the previous government should never have happened, and while the committee acknowledged that practices have improved, we continue to make changes and improvements to data processing across the ministry, such as introducing a dedicated, secure casework system for Afghan resettlement.
“This government lifted the injunction in July so that the public and parliament could examine this properly.”
The spokesman said the government had published the cost of all Afghan resettlement plans in its 2024 spending audit, claiming that “the overall financial cost was never hidden”.
MPs emphasized that the Ministry of Defense failed to accurately determine or calculate the cost of relocating thousands of Afghans as a result of the breach. Although the department said the total cost was around £850 million, the NAO said it had no confidence in the accuracy or completeness of this estimate.
The committee asked the Ministry of Defense to provide updates on how many people came to the UK as a result of the breach and to confirm that a new casework system introduced to handle Afghan applications will prevent a repeat of the breach in February 2022.
The Ministry of Defense believes that an estimated 27,278 people affected by the data breach could be resettled in the UK. However, the report noted that only 3,383 people came to the UK under the scheme for those affected by the spill.
The PAC report said the Ministry of Defense predicted it would take several years for everyone eligible to come to the UK to be brought to safety.
The lack of oversight of the Ministry of Defense’s response to the Afghan data breach has prompted people “at the highest levels in the government” to propose a parliamentary oversight committee that would deal with more sensitive aspects of defense work, such as maintaining the nuclear deterrent. MPs said the proposal was “moving too slowly”.
