Thousands of people are being relocated to the UK as part of a secret £850 million scheme set up after a personal data leak of Afghans who supported British troops, it can now be reported.
A dataset containing the personal information of nearly 19,000 people who applied for the Afghan Relocations and Assistance Policy (Arap) was released “in error” in February 2022 by a defence official.
The breach resulted in the creation of a secret Afghan relocation scheme – the Afghanistan Response Route - and an unprecedented legal cover-up.
The scheme was launched in April 2024 and is understood to have cost around £400 million so far, with a projected cost once completed of around £850 million.
Millions more is expected to be paid in legal costs and compensation.
Data protection watchdog the Information Commissioner's Office (ICO) called the breach “a deeply regrettable incident that placed thousands of vulnerable people at risk”, and warned it “should never happen again.”
The leak contained the names, contact details and some family information of people potentially at risk of harm from the Taliban.
Speaking to MPs on Tuesday, Defence Secretary John Healey offered a “sincere apology” for the massive data breach.
He told the Commons: “My first concern has been to notify as many as possible affected by the data incident and provide them with further advice.
“The MoD (Ministry of Defence) has done this this morning, although I have to say to the House, it has not been possible to contact every individual on the dataset, due to its incomplete and out-of-date information.
“However, anyone who may be concerned can head to our new dedicated gov.uk website, wherein they will find more information about the data loss, further security advice, a self-checker tool which will inform them whether their application has been affected, and contact steps for the detailed information services centre, which the MoD has established.
“This serious data incident should never have happened.
“It may have occurred three years ago under the previous government, but to all those whose information was compromised, I offer a sincere apology today on behalf of the British Government, and I trust the shadow defence secretary, as a former defence minister, will join me.”
The MoD only became aware of the breach over a year after the release, when excerpts of the dataset were anonymously posted onto a Facebook group in August 2023.
Details on the dataset include the the names and contact details of the Arap applicants and names of their family members.
Arap was responsible for relocating Afghan nationals who had worked for or with the UK Government and were therefore at risk of reprisals once the Taliban returned to power in Kabul in 2021.
Between 80,000 and 100,000 people, including the estimated number of family members of the Arap applicants, were affected by the breach and could be at risk of harassment, torture or death if the Taliban obtained their data, judges said in June 2024.
However an independent review, commissioned by the Government in January 2025, concluded last month that the dataset is “unlikely to significantly shift Taliban understanding of individuals who may be of interest to them”.
Around 4,500 people – made up of 900 Arap applicants and approximately 3,600 family members have been brought to the UK or are in transit so far through the Afghanistan Response Route.
A further estimated 600 people and their relatives are expected to be relocated before the scheme closes, with a total of around 6,900 people expected to be relocated by the end of the scheme.
Projected costs of the scheme may include relocation costs, transitional accommodation, legal costs and local authority tariffs.
It is understood that the unnamed official had emailed the dataset outside of a secure government system while attempting to verify information, believing the dataset to only have around 150 rows.
However, there were more than 33,000 rows of information which were inadvertently sent.
An unprecedented superinjunction was made at the High Court in September 2023 to reduce the risk of alerting the Taliban to the existence of the data, with the decision to apply for an order made by then-defence secretary Ben Wallace.
The ICO and Metropolitan Police were also informed.
The superinjunction, lifted on Tuesday, is thought to be the longest lasting order of its kind and the first time the Government has sought such a restrictive measure against the media.
At multiple hearings, lawyers for the MoD said in written submissions that there was a “very real risk that people who would otherwise live will die” if the Taliban gained access to the data.
However, a recent report by retired civil servant Paul Rimmer said: “Given the data they already have access to as the de facto government, we believe it is unlikely the dataset would be the single, or definitive, piece of information enabling or prompting the Taliban to act.”
Mr Rimmer further found that the Government possibly “inadvertently added more value to the dataset” by seeking the unprecedented superinjunction and creating a bespoke resettlement scheme.
Under plans set out last October, the Afghanistan Response Route was expected to allow up to 25,000 people – most of whom were ineligible for Arap but deemed to be at the highest risk from Taliban reprisals – to be relocated.
One internal Government document from February this year said: “This will mean relocating more Afghans to the UK than have been relocated under the Arap scheme, at a time when the UK’s immigration and asylum system is under significant strain. This will extend the scheme for another five years at a cost of c. £7 billion.”
However, the resettlement schemes are closing, with the review suggesting that the Afghanistan Response Route may be “disproportionate” to the impact of the Taliban obtaining the information.
As of March 2025, around 36,000 people had been relocated to the UK under Arap and other resettlement schemes.
Arap, which was launched in April 2021, is now closed to new applicants after immigration rule changes were laid in Parliament earlier this month.
The Government had originally outlined plans to launch a compensation scheme for those affected by the breach, with an estimated cost of between £120 and £350 million, not including administration expenses.
Hundreds of data protection legal challenges are also expected, with the court previously told that a Manchester-based law firm already had several hundred prospective clients.
The breach can now be reported after a High Court judge lifted the superinjunction – which prohibited making any reference to the existence of the court proceedings and is thought to have been the longest and widest ranging of its kind – on Tuesday.
In one of several rulings, judge Mr Justice Chamberlain noted the superinjunction “imposed very wide-ranging restrictions”, with information about the breach limited to selected officials.
In a decision in November 2023, Mr Justice Chamberlain said while the superinjunction did not constrain what could be said in Parliament, “MPs and peers cannot ask questions about something they do not know about”.
The judge ruled in May 2024 that the order should be lifted, stating there was a “significant possibility” the Taliban knew about the dataset, adding it was “fundamentally objectionable” that decisions about thousands of people’s lives and “enormous sums of public money now being committed” were being taken in secret.
However, judges at the Court of Appeal overturned this ruling the following month, finding that he had not properly considered the consequences of lifting the order and that the superinjunction should stay in place.
Following the retired civil servant’s review, the MoD agreed on July 4 that the order could be lifted.
It is expected that the cost of seeking and maintaining the superinjunction will be several million pounds.
Shadow defence secretary James Cartlidge said the Conservatives support the Government's decision to close the Afghanistan Response Route after the findings of the Rimmer Review.
He said: “Any threat picture is constantly evolving and, as I say, I support the Secretary of State's decision to review the MoD's understanding of the threat.
“And, given the latest situation as reported by Rimmer, we support his conclusion that the Afghanistan Response Route, the ARR, can now be closed.”
In her full statement Emily Keaney, deputy commissioner at the ICO, said: "This is a deeply regrettable incident that placed thousands of vulnerable people at risk.
"While we have been unable to comment on this matter publicly until now, I want to reassure the public that our expert team has been working behind the scenes to support and providing scrutiny to this internal investigation into what is a complex and sensitive situation.
"Data protection should never be a barrier to sharing information when this is needed to prevent harm and we accept that the initial sharing of the document was intentional and considered under the circumstances.
"However, there were mistakes made beyond this, with hidden data in the spreadsheet.
"We have been clear with the Ministry of Defence that this incident is unacceptable and should never happen again - the stakes are simply too high.
"The public must be able to trust that the Government has measures in place to protect the personal information and security of the most vulnerable people.
"We have supported the Ministry of Defence with its internal investigation and carefully considered the specific circumstances under which the breach occurred, including the critical need to share data urgently in this situation.
"We're reassured that the Ministry of Defence's investigation has resulted in taking necessary steps and minimised the risk of this happening again.
"We have also considered the proportionality of further action while the Ministry of Defence rightly take steps to protect those most affected.
"We are satisfied that no further regulatory action is required at this time in this case."
