UK military has failed to improve data safeguards after massive Afghan leaks

The Ministry of Defence (MOD) has not fixed data safeguards despite a massive leak of secret information about Afghanistan in 2022, a report has found. The Public Accounts Committee (PAC) also said the MOD knew it had serious issues at the time.

The 2022 breaches exposed the details of thousands of Afghans who had worked for the British occupation forces. The MOD didn’t even realise the leak had taken place until 2023. It then got a super-injunction to block newspapers from reporting it. The UK then ran a secret relocation program to get Afghans affected out of the country. But Afghans who have not escaped report living in fear as a direct result of the breaches.

The PAC said:

The Department’s poor management of personal information put the lives of many thousands of Afghans at risk. A significant data breach occurred in February 2022 which has led to an estimated 7,355 people becoming eligible to be resettled in the UK through the ARR [Afghan Response Route].

The Department set up this scheme to relocate those who were at high risk of being targeted by the Taliban because their personal information was included in the data breach, and their family members.

Later, a further 16,108 people “affected by the data breach” were identified.

In total, the Department has estimated that up to 27,278 people affected by the data breach could be resettled in the UK.

Afghan leaks: still leaking like a sieve

Despite efforts to stop data breaches, they have continued. The PAC said that as of August 2025 MOD figures showed there had been another 49 separate data breaches:

The Department continues to work to reduce the risk of further data breaches, but it has not given us confidence that sufficient action has yet been taken.

Those who supported the NATO-led war are at risk of reprisals from the ruling Taliban. The Taliban view them as collaborators. Research submitted in October 2025 details violence meted out as a result of the breaches.

One former soldier, now in the UK, said his “personal car was taken, and our home has been searched multiple times”

My father was brutally beaten to the point that his toenails were forcibly removed, and my parents remain under constant and serious threat. My family and I continue to face intimidation, repeated house searches, and ongoing danger to our safety.

Another described living “in constant fear and stress”.

I suffer from anxiety, sleepless nights, and extreme worry for the safety of myself and my family.

Left alone in the dark

The Refugee Legal Support charity said the data breach had had “devastating consequences for many individuals and families”.

The UK Government must act decisively to protect those affected, restore trust, and ensure that such a failure never happens again; or that if it does, those placed at risk will not also be left alone in the dark.

Britain’s 20 year war in Afghanistan ended in abject failure in 2021. Many eligible Afghans were resettled, others remain in danger. The breaches are one example of how the deadly legacy of the war continues to ruin lives.

Unlike Iraq, there has never been an large-scale inquiry into the Afghan debacle. Though allegations of UK war crimes are currently being investigated. Without an inquiry, we’ll never know the full scale of the damage caused. And it’s hard to see how any lessons will be learned.

Featured image via the Canary