Explainer

Guide to the Afghan data breach: Why scandal has erupted now and what happens next

Thousands of Afghan nationals are coming to the UK after the British military accidentally compromised their data. But what was the blunder, who has been affected and how much is it predicted to cost the UK?

Thursday 17 July 2025 09:50, UK

Why you can trust Paste BN

The safety of tens of thousands of Afghan nationals has been compromised in a massive data breach by the British military that successive governments tried to keep secret.

Details about the blunder were only made public on Tuesday, despite it having happened more than three years ago.

The cost to the taxpayer could stretch to billions of pounds, as the government pays to relocate thousands of Afghan nationals named in the breach.

Here we look at how the leak happened - and how it was covered up for so long - who has been affected, and how much it could cost.

Latest: Minister won't name person behind Afghan data breach

What was the data breach?

An unnamed official accidentally shared emails with the names and other details of 18,714 Afghan nationals who were applying for a British government relocation scheme in 2022.

Taking into account the family members of those named, it is thought up to 100,000 people could be impacted by the breach.

The official sent the email in an attempt to verify information, believing the dataset only contained about 150 rows of information - when it actually contained around 33,000.

The scheme was to provide asylum for people who had worked with the UK armed forces in the war against the Taliban between 2001 and 2021, who could be at risk of reprisals in Afghanistan.

The Taliban, which took full control of Afghanistan in 2021, regards anyone who worked with British or other foreign forces during the previous two decades as a traitor.

Why are we only learning about this now?

The leak was first discovered by the British military in August 2023, when an anonymous Facebook user posted a small excerpt of the dataset.

A super-injunction was imposed in September of that year after the government appealed to the High Court, meaning the media could not report the breach.

The government said it made the move in an attempt to keep news of the leak from spreading to the Taliban.

It is not clear whether the Taliban has the list - only that the Ministry of Defence (MoD) lost control of the information.

Sir Keir Starmer's Labour government inherited the scheme and kept the super-injunction in place.

But it was lifted on Tuesday, making the breach reportable for the first time.

Defence Secretary John Healey told Matt Barbet on Paste BN Breakfast he was "deeply uncomfortable" with the government using a super-injunction, but suggested Labour deemed it necessary to keep in place when they took power to assess "the risks" of making the breach public.

Why was the super-injunction lifted?

A High Court judge's ruling that the injunction could be lifted was based on the findings of an internal review launched at the start of this year by Paul Rimmer, a retired civil servant.

The review played down the risk to those whose data was breached should the list fall into the hands of the Taliban.

The review said it was "unlikely to substantially change an individual's existing exposure given the volume of data already available".

It also concluded that "it appears unlikely that merely being on the dataset would be grounds for targeting" and it is "therefore also unlikely that family members... will be targeted simply because the 'principal' appears... in the dataset".

Mr Rimmer said the leak and the subsequent scheme to bring those at risk to the UK can now face "proper scrutiny and accountability".

Timeline: How the super-injunction happened

April 2021: Initial scheme to relocate Afghans who helped British military during war launched.

February 2022: Defence official accidentally leaks emails with details of 18,714 Afghan nationals who applied to be relocated.

14 August 2023: The MoD discovers the leak after seeing details of the emails had been posted by a Facebook user.

25 August 2023: Then defence secretary Ben Wallace applies for a court order after the MoD gets two inquiries about the breach from journalists.

1 September 2023: High Court grants a super-injunction until a hearing scheduled for 1 December, preventing the reporting of the breach and relocation scheme.

23 November 2023: High Court judge Mr Justice Chamberlain gives private judgment saying super-injunction is "is likely to give rise to understandable suspicion that the court's processes are being used for the purposes of censorship". He continues it for four more weeks.

18 December 2023: MoD lawyers say risk to life due to the breach is "immensely serious". Mr Justice Chamberlain extends the super-injunction until February 2024.

15 February 2024: Mr Justice Chamberlain continues the super-injunction, finding a "real possibility that it is serving to protect" some of those identified on the dataset – but acknowledges decisions are being taken "without any opportunity for scrutiny through the media or in Parliament".

21 May 2024: Mr Justice Chamberlain rules super-injunction should be lifted in 21 days, saying there is a "significant possibility" the Taliban already know about the dataset and that it is "fundamentally objectionable" to keep it a secret.

25-26 June 2024: MoD challenges the decision in the Court of Appeal, which rules that the super-injunction should continue for the safety of those affected by the breach.

19 May 2025: The High Court is told by a Manchester-based law firm that it has more than 600 potential clients who may sue the government under data protection laws.

4 July 2025: After an independent review by retired civil servant Paul Rimmer, the government tells the High Court that the super-injunction "should no longer continue". It comes after the review found the breach was "unlikely to profoundly change the existing risk profile" of those named and that the government possibly "inadvertently added more value to the dataset" by seeking the unprecedented super-injunction.

How much could the breach cost?

In 2023, the government set up a second relocation scheme for Afghans who were affected by the breach but not eligible for the initial relocation scheme.

The MoD said the relocation costs directly linked to the data breach will be around £850m.

An internal government document from February this year said the cost could rise to £7bn, but an MoD spokesperson said that this was an outdated figure because the government had cut the number of Afghans it would be relocating.

However, the cost to the taxpayer of existing schemes to assist Afghans deemed eligible for British support, as well as the additional cost from the breach, will come to at least £6bn.

Litigation by victims of the breach could add additional cost for the government - in addition to what it has already spent on the super-injunction.

What happens now?

Some 5,400 Afghans who have already received invitation letters will be flown to the UK in the coming weeks. This will bring the total number of Afghans affected by the breach being relocated to the UK to 23,900.

The rest of the affected Afghans will be left behind, The Times reported.

Around 1,000 Afghans on the leaked list are preparing to sue the MoD, demanding at least £50,000 each, in a joint action led by Barings Law.

Adnan Malik, head of data protection at Barings Law, said: "This is an incredibly serious data breach, which the Ministry of Defence has repeatedly tried to hide from the British public."

Despite the government's internal review playing down the risks caused by the data breach, Mr Malik said the claimants "continue to live with the fear of reprisal against them and their families".

The Telegraph has reported that a Whitehall briefing note circulated on 4 July warned that the MoD would need to work with the government to prepare to "mitigate any risk of public disorder following the discharge of the injunction".