UK Admits Data Leak Affected 18,000 Afghanistani Refugees

DID Press: UK Ministry of Defence admitted in an official letter that around 50 data breaches occurred within its Afghanistani resettlement programmes, exposing the personal information of thousands of refugees.

According to the ministry, one of the breaches compromised the personal details of about 18,700 Afghanistani applicants under the resettlement scheme. The disclosure became public in July following lifting of a confidentiality order, with the overall financial impact estimated at £850 million.

A letter from “Williams,” issued after a session of the Public Accounts Committee, confirmed that 49 separate data incidents had been recorded in connection with the Afghanistani resettlement initiative — but only five were formally reported to the regulatory authority.

Among the breaches was an error involving a spreadsheet created in February 2022, which went undetected until August 2023. Three other cases stemmed from misuse of the “blind copy” (BCC) email function in 2021, resulting in a £350,000 fine for the Ministry of Defence.

Other incidents included insecure WhatsApp messages, misdirected emails, and sensitive data being displayed on laptops in public places — including on a train.

Despite limited number of cases formally reported, the Defence Secretary said the regulator was satisfied with the ministry’s follow-up actions.

The Defence Committee has since launched a detailed investigation into February 2022 breach.

The crisis originated from an administrative error in January 2022, which led to the exposure of personal data belonging to roughly 18,700 Afghanisatni nationals. UK government remained unaware of the breach for more than a year, and its public disclosure was initially blocked by a court order.

In response, the government established a covert initiative known as the “Afghanisatni Response Pathway” to relocate at-risk individuals to the United Kingdom. So far, around 4,500 people have been evacuated under the scheme, costing approximately £400 million, with projections suggesting total costs could reach £7 billion.

At least 1,000 victims of the data breach are reportedly preparing to sue the government with the assistance of a legal firm, which has accused officials of deliberate concealment. Reports also indicate that some individuals named in the leaked documents were later killed by the Taliban.