MoD breach was 'foreseeable' failure that left Afghans in danger, say MPs

A massive breach by the British military over thousands of Afghans' personal data was a "foreseeable" failure and it should not have been allowed to run relocation schemes, a parliamentary inquiry has said.

The Ministry of Defence lacked the expertise to organise such schemes and had used secrecy as a "shield" against accountability, said a committee of MPs.

It added the breach happened in a system that left Afghans who had worked with British troops in danger for years.

The inquiry began last year after it was revealed the personal data of thousands of Afghans applying for relocation to the UK had been inadvertently disclosed in February 2022, six months after the Taliban took over the capital Kabul.

Read more:
Afghan data breach timeline
Guide to the breach

The discovery of the breach in August 2023, when details of applicants were shared on a Facebook page, sparked the creation of a secret relocation route for those affected.

But an unprecedented superinjunction prevented the breach being made public until July 2025, soon after applications to the government's relocation schemes closed.

The breach was caused by a member of MoD personnel sharing an Excel spreadsheet with a "trusted third party".

It was among 19 "data security incidents" reported between February 2022 and November 2023.

The breach was not "an individual mistake" but a "foreseeable systemic failure" caused by "inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability", the defence committee found.

While the spreadsheet was thought to contain data for around 150 applicants to the Afghan Relocations and Assistance Policy (Arap) scheme, it contained hidden data relating to more than 18,500 other applications.

The MoD's approach to using Excel was a "continuing cultural failure" and criticised its handling of the wider Afghan relocation schemes as "utterly and obviously inadequate", according to the inquiry.

Committee chairman Tan Dhesi said: "The Ministry of Defence should stick to defence – it should never have been left to run immigration casework schemes."

Reports have suggested that the initial breach was linked to UK special forces' involvement in deciding applications for relocations from their Afghan counterparts, the so-called "Triples".

While the committee did not reach a conclusion about who had sent the email that caused the breach, it said special forces' involvement "should not prevent parliament and the public from understanding how administrative failings occurred".

Mr Dhesi said: "Secrecy has been too easily used as a shield against proper accountability in areas far removed from sensitive operations."

The MPs also raised concerns about the handling of the Triples, who had worked closely with UK forces but in hundreds of cases had their applications for resettlement refused.

The committee said the government had "a special responsibility to former Triples whose applications were wrongly refused and who, because of those failings and subsequent delay, may have spent additional years in hiding or been left to make their own way to a third country".

The Ministry of Defence has been approached for comment.

(c) Sky News 2026: MoD breach was 'foreseeable' failure that left Afghans in danger, say MPs