A significant data breach, which resulted in the clandestine relocation of thousands of Afghans to the UK, has come to light this week for the first time.
The High Court ruled on Tuesday that the details should be made public; however, the revelations have prompted numerous questions.
In February 2022, a spreadsheet containing the personal data of nearly 19,000 individuals who had sought relocation to the UK to escape the Taliban was inadvertently leaked by a Ministry of Defence official.
The unnamed official emailed the document outside of the government team responsible for processing Afghan relocation applications, leading to its entry into the public domain.
Police determined that no investigation was necessary, but it remains unclear whether the official is still employed by the government.
The leaked document included the names, contact information, and in some instances, family details of a substantial number of individuals who believed their association with British forces during the Afghanistan war could place them at risk.
The leak was discovered in August 2023, when the names of nine applicants for UK relocation were found on Facebook.
Recognizing the breach, the government, fearing the information could fall into the hands of the Taliban, sought a court injunction to suppress its dissemination.
By September 2023, it was estimated that as many as 100,000 individuals, including family members, could be affected by the leak.
In April 2024, the government secretly established the Afghanistan Response Route (ARR) to provide a means of evacuation for those whose data had been compromised, without informing them of the leak.
This new, covert route operated separately from the primary Afghan Relocations and Assistance Policy (Arap) scheme.
By May 2024, evidence presented to the court indicated that approximately 20,000 individuals could be eligible for relocation under the new scheme.
Defence Secretary John Healey stated on Tuesday that approximately 900 individuals are already in the UK or en route, along with 3,600 family members.
An additional 600 offers have been extended, though it is unclear whether this figure includes the families of those offered relocation.
The number of individuals on the leaked list who remain in Afghanistan is currently unknown.
Since the withdrawal of international troops, approximately 36,000 Afghans have been relocated to the UK. Both the ARR and Arap schemes are now closed.
It remains unconfirmed whether anyone suffered harm as a direct consequence of the leak, and the MoD has declined to comment on this matter.
However, a government review conducted in early 2025 by retired civil servant Paul Rimmer suggested that the leaked document “may not have spread nearly as widely as initially feared,” casting doubt on previous assessments of its value to the Taliban.
Mr. Rimmer concluded that, given the Taliban’s existing access to extensive data on the Afghan population, the leaked information was “unlikely” to be the sole basis for reprisal attacks.
He noted that while killings and human rights abuses against former officials occur, concerns about a widespread retribution campaign have “diminished.”
However, those whose data was compromised view the leak as a catastrophic failure that has heightened the risk to themselves and their families.
The government has spent £400 million on the scheme to date and anticipates an additional expenditure of £450 million.
These figures are significantly lower than estimates presented in secret High Court proceedings in May 2024, which suggested potential costs of “several billions.”
The government estimates that the total cost of all efforts to relocate Afghans since 2021 will be approximately £5.5-£6 billion.
Then-Defence Secretary Ben Wallace applied to the High Court on September 1, 2023, seeking an injunction to criminalize the public disclosure of the leak.
The government feared that the Taliban could exploit the list to target individuals.
Mr. Justice Knowles deemed the request “exceptional” and exceeded the government’s initial request, upgrading it to a super-injunction. This prohibited both the disclosure of the leak’s details and any reference to the existence of the court order.
The order was regularly reviewed by Mr. Justice Chamberlain, who noted in November 2023 that it was the first injunction of its kind and raised concerns about freedom of speech.
He sought to lift the order the following May, but the government appealed, and it remained in effect until being lifted on Tuesday.
A separate injunction was granted to prevent the publication of some of the most sensitive information contained in the leaked document.
From August 2023, efforts were made to limit the number of MoD officials aware of the leak, and it is unclear when then-Prime Minister Rishi Sunak and other cabinet ministers were informed.
In December 2023, Healey, then shadow defence secretary, was briefed on the leak by then-Armed Forces Minister James Heapey.
Healey stated that the wider shadow cabinet was not informed until after the general election.
MPs were never informed of the leak, raising questions about the ability of the House of Commons to scrutinize the matter.
BBC News understands that Labour ministers decided last Autumn to examine whether to lift the super-injunction.
Hearings were held in November 2024, and a senior MoD source told BBC News that the government’s position at that time was to maintain the super-injunction “pending further work.”
However, the source indicated that ministers had privately agreed a review of the possibility of ending the super-injunction was necessary.
By the time the super-injunction was lifted, seven media organizations were aware of the leak and had been prevented from publishing details.
Additional reporting by Jack Fenwick
The existence of the scheme could not be reported until now because of a court injunction.
The BBC’s security correspondent Frank Gardner analyses the leak of Afghan citizens’ data and the fallout.
Delays and personnel shortages are “undermining the armed forces’ warfighting capability”, a report says.
Donja was adopted by her handler and is now a loyal guardian and companion for his wife.
Afghans whose personal information was mistakenly exposed by the Ministry of Defence to get up to £4,000 each.