UK parliamentary inquiry: MoD's 2023 Afghan data breach was a foreseeable systemic failure

Image caption: Britain set up a scheme to bring those thought to be the most in danger to safety

By Henry Moore and Hannah O'Grady

A data breach that exposed personal details of thousands of Afghans applying to come to the UK to flee the Taliban was a "foreseeable" failure, a parliamentary inquiry has found.

In a report published on Thursday, the Commons' Defence Committee said the Ministry of Defence (MoD) had lacked the expertise to run the UK's Afghan relocation scheme after the fall of Kabul to the Taliban and had used secrecy as a "shield" against proper accountability.

The breach came to light in August 2023, but an unprecedented super-injunction prevented it from being reported on until July 2025.

An MoD spokesperson said the leak "should never have happened" and welcomed the opportunity to learn from the incident.

• Man's anger as brother left in Afghanistan after data breach

What is a Super-Injunction?

A super-injunction is a court-mandated gagging order that forbids news outlets from reporting private or sensitive information. It also bans the media from revealing that the injunction exists.

Systemic Failure, Not Individual Mistake

The leak was not "an individual mistake" but a "foreseeable systemic failure" caused by "inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability", the Defence Committee said in its report.

The breach — just one of 19 reported between February 2022 and November 2023 — was caused by a member of MoD personnel sharing a Microsoft Excel spreadsheet with a "trusted third party", the committee added. The BBC previously revealed the breach had originated from UK Special Forces (UKSF) headquarters.

The spreadsheet contained data of more than 18,500 applicants to the Afghan Relocations and Assistance Policy (Arap) scheme — every person who had applied to the scheme by January 2022.

About the Arap Scheme

Arap was set up in April 2021 to help people who feared their lives were at risk because they had worked with British armed forces in Afghanistan, and to resettle eligible applicants and their family members in the UK. It was closed in July 2025.

Criticism of MoD and Secrecy

Committee chairman Tan Dhesi said: "The Ministry of Defence should stick to defence — it should never have been left to run immigration casework schemes."

The report branded the MoD's use of Excel a "continuing cultural failure" and described the wider Afghan relocation scheme as "utterly and obviously inadequate".

Dhesi also hit out at the secrecy surrounding the breach and said the length of the super-injunction "imposed serious costs on accountability and trust". It was originally expected to last four months, the report found, but remained in place for almost two years.

• What we know so far about Afghan data breach
• How bad is Afghan data breach for MI6 and SAS?

Parliamentary Briefing and Special Forces Involvement

The committee also questioned the decision not to provide confidential briefing to parliamentarians, with then-Defence Secretary Grant Shapps pushing back against plans to tell then-shadow defence secretary John Healey of the breach.

Thursday's report also questioned the government's overarching policy to not comment on special forces matters, describing it as "inappropriate" in the context of the breach.

The committee added that special forces involvement "should not prevent Parliament and the public from understanding how administrative failings occurred".

Dhesi said: "Secrecy has been too easily used as a shield against proper accountability in areas far removed from sensitive operations."

UKSF Role in Resettlement Scheme

The role of UKSF in the resettlement scheme was also questioned by the committee after reports the breach had been due to their involvement in deciding whether to relocate Afghan special forces.

The committee was unable to establish this connection, due to the "neither confirm nor deny" policy of the government, but it did raise concerns over the handling of these cases.

In February 2024, BBC Panorama revealed that British Special Forces had been given a de facto veto over Arap applications from their Afghan counterparts seeking to relocate to safety in the UK.

Afghan special forces served alongside UKSF on some of the conflict's most dangerous missions and are considered among those at the highest risk of reprisal since the Taliban takeover.