A significant data breach, which precipitated the clandestine relocation of thousands of Afghan individuals to the United Kingdom, came to light publicly this week.
On Tuesday, the High Court mandated the release of pertinent details, yet the revelations have prompted a range of unresolved inquiries.
In February 2022, a spreadsheet containing the personal data of nearly 19,000 Afghans—individuals seeking refuge in the UK due to potential Taliban retribution—was inadvertently leaked by a Ministry of Defence (MoD) official.
The document, containing sensitive information, was emailed outside the designated government team responsible for processing Afghan relocation applications, subsequently entering the public domain.
While police determined that no investigation was warranted, the employment status of the official in question remains undisclosed.
The compromised document included names, contact information, and familial details of numerous individuals who believed their association with British forces during the Afghanistan conflict placed them at risk.
The breach was discovered in August 2023 after the names of nine applicants were posted on Facebook.
Recognizing the potential for the information to fall into the hands of the Taliban, the government sought a court injunction to suppress any knowledge of the breach.
By September 2023, it was estimated that up to 100,000 individuals, including family members, could be affected by the leak.
In April 2024, the government established the Afghanistan Response Route (ARR) in secrecy, offering a means of relocation for those whose data had been compromised—without informing them of the breach.
This covert route was distinct from the primary Afghan Relocations and Assistance Policy (Arap) scheme.
By May 2024, evidence presented in court suggested that approximately 20,000 individuals might be eligible for relocation under the ARR.
Defence Secretary John Healey stated on Tuesday that roughly 900 individuals are currently in the UK or en route, along with 3,600 family members.
An additional 600 offers have been extended, although it remains unclear whether this figure includes family members.
The number of individuals on the leaked list still residing in Afghanistan is currently unknown.
Since the withdrawal of international troops, approximately 36,000 Afghans have been relocated to the UK. Both the ARR and Arap schemes are now closed.
While it is impossible to definitively attribute harm directly to the leak, the MoD has declined to comment on this matter.
However, a government-commissioned review conducted in early 2025 by retired civil servant Paul Rimmer suggested that the leaked document “may not have spread nearly as widely as initially feared,” questioning prior assessments of its value to the Taliban.
Mr. Rimmer posited that, given the Taliban’s existing access to extensive population data, the leaked information was “unlikely” to be the sole catalyst for reprisal attacks.
He noted that while killings and human rights abuses against former officials have occurred, concerns regarding a widespread retribution campaign have “diminished.”
Nevertheless, those whose data was compromised perceive the leak as a catastrophic failure that has amplified risks to themselves and their families.
The government has allocated £400 million to the scheme thus far, with an anticipated additional expenditure of £450 million.
These figures are significantly lower than the “several billions” estimated during closed-door High Court proceedings in May 2024.
The government projects that total costs for Afghan relocation efforts since 2021 will amount to approximately £5.5-£6 billion.
Then-Defence Secretary Ben Wallace sought a High Court injunction on September 1, 2023, to criminalize public disclosure of the leak.
The government feared the Taliban could exploit the list to target individuals.
Mr. Justice Knowles deemed the request “exceptional” and upgraded it to a super-injunction, making it illegal to reveal leak details or reference the court order’s existence.
Mr. Justice Chamberlain, who conducted regular reviews, described it in November 2023 as an unprecedented injunction that raised freedom of speech concerns.
He attempted to lift the order the following May, but the government appealed, and it remained in effect until Tuesday.
Another injunction was granted to prevent the public disclosure of highly sensitive details from the leaked document.
Efforts were made to restrict the number of MoD officials aware of the leak from August 2023 onwards, and it remains unclear when then-Prime Minister Rishi Sunak and other cabinet ministers were informed.
In December 2023, Healey—then shadow defence secretary—was briefed on the leak by then-Armed Forces Minister James Heapey.
Healey indicated that the broader shadow cabinet was not informed until after the general election.
The absence of parliamentary awareness regarding the leak has raised questions concerning the Commons’ ability to scrutinize the matter.
BBC News understands that Labour ministers decided last Autumn to assess the potential lifting of the super-injunction.
Hearings were held in November 2024, and a senior MoD source told BBC News that the government’s position at that time was to maintain the super-injunction “pending further work.”
However, the source stated that ministers had privately agreed that a review exploring the possibility of ending the super-injunction was warranted.
By the time the super-injunction was lifted, seven media organizations were aware of the leak and had been prevented from publishing details.
Additional reporting by Jack Fenwick
The existence of the scheme could not be reported until now because of a court injunction.
The BBC’s security correspondent Frank Gardner analyses the leak of Afghan citizens’ data and the fallout.
Delays and personnel shortages are “undermining the armed forces’ warfighting capability”, a report says.
Donja was adopted by her handler and is now a loyal guardian and companion for his wife.
Afghans whose personal information was mistakenly exposed by the Ministry of Defence to get up to £4,000 each.