Sensitive data includes names, contact details, and familial information
A major security lapse by a British government official led to the covert relocation of thousands of Afghans to the United Kingdom, it emerged on Tuesday after a High Court ruling lifted a year-long gag order.
The leak, which occurred in February 2022, exposed the personal details of nearly 19,000 Afghans who had applied to relocate to the UK following the Taliban’s return to power in August 2021.
The sensitive data included names, contact details, and familial information — many of whom were at risk of Taliban reprisal due to their past affiliations with foreign forces.
The breach came to the attention of the UK government in August 2023 after fragments of the leaked data were discovered circulating on Facebook. In response, British authorities discreetly set up a new scheme — officially titled the Afghan Relocation Route — which has since facilitated the migration of 4,500 Afghans to the UK.
The existence of the leak and subsequent resettlement efforts was kept from public knowledge through a sweeping super-injunction — a rare legal mechanism which not only barred media from reporting on the story but also prohibited disclosing the injunction itself.
On Tuesday, however, Mr Justice Chamberlain ruled that continued suppression of the matter was no longer justified, stating the order had created a “scrutiny vacuum” and hindered democratic accountability.
Official response and costs
Speaking in the House of Commons, Defence Secretary John Healey offered an “unreserved apology” to those affected by what he termed a “serious departmental error”. The breach occurred when a Ministry of Defence (MoD) employee mistakenly sent a spreadsheet outside official government channels.
Healey confirmed that the leak included details of senior Afghan military officials, UK government contacts, and Members of Parliament. While a police investigation was ruled unnecessary by the Metropolitan Police, the MoD has not disclosed whether any disciplinary action was taken against the official responsible.
The Afghan Relocation Route, which was established nine months after the breach was first detected, has already cost the British government £400 million, with projections suggesting an additional £400 to £450 million will be needed to fulfil outstanding obligations. Although the scheme is now being wound down, existing relocation offers to remaining Afghans will be honoured.
Remaining at risk
According to official figures, approximately 600 Afghan soldiers whose details were compromised — along with 1,800 of their family members — remain in Afghanistan. The government acknowledged it only began notifying affected individuals of the breach on Tuesday, advising them to exercise digital caution and avoid unfamiliar online contacts.
A confidential internal review concluded that the leak was unlikely to result in targeted attacks, suggesting the data “may not have spread as widely as initially feared”. However, the review acknowledged that Taliban-linked individuals might have viewed parts of the list on Facebook.
Legal and human rights experts criticised the MoD’s handling of the situation. Erin Alcock, a lawyer at Leigh Day, which represents numerous Arap applicants, called the breach a “catastrophic failure” and warned of lasting consequences for those whose lives were placed in danger.
Political fallout
Former Defence Secretary Ben Wallace was revealed to have personally sought the super-injunction in 2023, arguing that it would buy time for the government to protect those endangered by the data breach. The court later extended the injunction amid fears that public disclosure could alert the Taliban.
However, Mr Justice Chamberlain determined this rationale no longer held, stating that the Taliban “likely already possess the key information in the dataset”.
Kemi Badenoch, the Conservative Party leader, publicly apologised for her party’s role in the incident, stating: “Somebody made a terrible mistake… and we are sorry for that. That should not happen.”
Shadow Defence Secretary James Cartlidge added that the incident was “an unacceptable breach of all relevant data protocols” and urged the government to review its handling of Afghan resettlement efforts.
The episode adds to mounting criticism of the UK’s withdrawal and evacuation operations from Afghanistan. A 2022 parliamentary report labelled the effort a “disaster” and a “betrayal” of those left behind, many of whom had worked alongside British and NATO forces during the two-decade war.
End of secrecy
Tuesday’s revelations have reignited concerns about transparency, accountability, and data protection within the UK’s defence and immigration systems. The court ruling lifting the super-injunction now allows journalists and civil society to scrutinise a decision that had remained hidden from public view for over a year.