UK MoD Afghan data breach deemed foreseeable failure by parliamentary inquiry
A parliamentary Defence Committee inquiry found that a February 2022 data breach at the UK Ministry of Defence (MoD) exposed the personal details of more than 18,500 Afghans who had applied to the Afghan Relocations and Assistance Policy (ARAP) scheme. The breach was caused by a staff member sharing an Excel spreadsheet with a trusted third party and was described as a "foreseeable systemic failure" arising from inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity and an inadequate culture of data protection.
The leak remained undiscovered until August 2023 and was concealed by an unprecedented super‑injunction that restricted reporting for almost two years. MPs criticised the MoD for running an immigration resettlement programme without the necessary expertise, for secrecy that delayed assistance, and for the continued plight of eligible Afghans who remain trapped in Afghanistan.
The ARAP scheme, set up in April 2021 by then Defence Secretary Sir Ben Wallace to relocate Afghans who worked with UK forces, was closed in July 2025. The committee, chaired by Tan Dhesi, called for periodic risk assessments, a clear policy on remaining eligible applicants and greater accountability from the MoD.
Entities: Afghan Relocations and Assistance Policy (ARAP) · Afghan allies (Afghans who worked with UK forces) · Ministry of Defence (UK) · Sir Ben Wallace · Tan Dhesi
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [● 2 SOURCES] The breach was caused by a MoD staff member sharing an Excel spreadsheet with a trusted third party. (defense committee report)
- [● 2 SOURCES] The committee called on the MoD to publish periodic risk assessments and a clear policy for remaining eligible Afghans. (defense committee report)
- [● 2 SOURCES] Many eligible Afghans remain trapped in Afghanistan with no clear pathway to the UK. (defense committee report)
- [● 3 SOURCES] The breach remained undiscovered until August 2023 and was concealed by a super‑injunction that lasted nearly two years. (defense committee report)
- [● 4 SOURCES] The committee labeled the breach a “foreseeable systemic failure” due to inappropriate tools, weak procedures, insufficient training, poor continuity and inadequate data‑protection culture. (defense committee report)
- [● 3 SOURCES] The ARAP scheme was established in April 2021 to resettle Afghans who worked with UK forces and was closed in July 2025. (defense committee report)
- [● 2 SOURCES] Sir Ben Wallace, then Defence Secretary, kept eligibility decisions separate from the Home Office, causing the MoD to design immigration databases from scratch. (defense committee report)
- [● 4 SOURCES] A February 2022 Ministry of Defence data breach exposed personal details of over 18,500 Afghan applicants to the ARAP scheme. (defense committee report)