Almost 100,000 Afghans had their lives placed in jeopardy by a Ministry of Defence data leak, judges were told in a closed-door hearing last year. The figure, disclosed in High Court documents, is more than five times the number that ministers admitted to Parliament — and exposes a disquieting gulf between what was known privately and what was stated publicly.
In a judgment handed down in December 2024, Mr Justice Chamberlain recorded that “on 28 February 2022, a member of Defence’s civilian staff inadvertently emailed a dataset containing the personal data of around 25,000 ARAP applicants and their family members (totalling approximately 100,000 people) to an individual outside Defence” (CX1 & Ors v Secretary of State for Defence & Anor [2024] EWHC 3214 (KB), para. 4).
The judgment continues: “officials considered offering an opportunity to apply for relocation to all of those affected by the data leak (almost 100,000 people, including family members)” and that “it gives risk to a risk of torture and a risk to life of almost 100,000 people (including family members) who have sought the assistance of the UK Government.”
The Afghan Relocations and Assistance Policy was intended to offer sanctuary to those who had worked with British forces or who faced the gravest threats from the Taliban. Many of the names on the list still lived in Afghanistan when the leak occurred.
Parliament heard a different number. On 15 July 2025 the Defence Secretary, John Healey, told MPs that the breach had affected “personal information associated with 18,714 Afghans”, adding that, in some cases, details of family members were also included. The gap between the two figures reflects the difference between counting principal applicants and including all relatives whose details were also recorded.
The breach itself went unnoticed for a year and a half. It came to light only in August 2023, when details of nine people from the dataset were found posted on Facebook. Within weeks the government had sought and obtained an unprecedented contra mundum super-injunction, an order binding “against the world”, to suppress the case’s existence.
In September 2023 the High Court, accepting that Taliban access to the data could lead to “reprisals, including torture or killing”, banned publication and restricted disclosure so tightly that even those affected were not told their information had been exposed.
The secrecy was maintained for almost two years. Mr Justice Chamberlain later warned that it “removed the ordinary mechanisms of accountability” and left a “scrutiny vacuum”. Parliament was not informed; journalists could not investigate. It was only in July 2025, when the order was allowed to lapse, that the public could see the scale of what had happened.
By then the MoD had commissioned Paul Rimmer, a former deputy chief of Defence Intelligence, to review the security implications. He concluded that Taliban possession of the leaked data was “unlikely to substantially change” existing risks, noting that the regime already had access to large troves of Afghan government records. Yet the breach had already triggered the creation of a special relocation scheme, the Afghanistan Response Route, for those named in the dataset but ineligible under ARAP.
The route has so far reporteldy brought 900 principal applicants and 3,600 family members to Britain at a cost of £400 million. A further 600 invitations will be honoured, likely pushing the bill to £800 million. Combined with ARAP and other programmes, Britain has spent an estimated £5.5–6 billion on Afghan resettlement since the fall of Kabul in 2021. The government argues that ending the route will save £1.2 billion and reduce arrivals by 9,500 people.
For those left behind, especially as Pakistan and Iran expel Afghan refugees back to Taliban control, the potential consequences of exposure remain severe.
Did you find this story interesting? Please support AOAV's work and donate.
Donate