MoD knew risks of using inappropriate data systems before Afghan leak, MPs say

The House of Commons Public Accounts Committee said the department “knew the risks” of using “inappropriate” data systems – namely Excel spreadsheets – to handle sensitive personal information amid a rapidly deteriorating security situation in Afghanistan.

The MPs also criticised the MoD for failing to calculate the total cost of a secret relocation plan it set up following the data breach, noting its £850 million estimate does not include costs of legal action or potential compensation claims.

In the summer, LBC revealed that almost 19,000 applicants for the Afghan Relocations and Assistance Policy (Arap) scheme were accidentally leaked in an emailed spreadsheet by a defence official in 2022.

Read more: How the UK silenced a scandal: My two year battle to reveal the truth by Lewis Goodall

Read more: Taliban fighters 'among those evacuated to UK' following Afghan data leak

When the blunder was discovered more than a year later in August 2023, the MoD was granted an unprecedented gagging order amid fears the Taliban could target would-be refugees for reprisals because of their work with the UK Government in Afghanistan.

It also saw the establishment of a secret scheme, the Afghanistan Response Route (ARR), to bring some of those affected to the UK.

An estimated 7,355 people who became eligible for resettlement after their information was leaked, added to those already included in the initial scheme, amount to some 27,278 candidates for relocation to the UK.

A total of 3,383 people had already arrived in the UK under the ARR by June 2025, the report said, citing Home Office statistics.

The Public Accounts Committee said the MoD was aware of the dangers of using inadequate data systems when the February 2022 breach happened, but “neither did enough to improve its processes, guidance and culture in response to this risk, nor to learn lessons from multiple data breaches over successive years”.

The cross-party panel urged the MoD to confirm it is now using a new casework system to manage all Afghan resettlement schemes and provide details of how it will prevent further data breaches.

Committee chairman and Tory MP Sir Geoffrey Clifton-Brown said: “The Ministry of Defence knew what it was doing – it knew the risks of using inadequate systems to handle sensitive personal information as the security environment in Afghanistan deteriorated.

“Indeed, data breaches occurred in 2021 which were sufficiently serious to have to be reported to the Information Commissioner’s Office, giving a warning which MoD should have taken steps to heed.

“These risks crystallised into dozens of data breaches over years, and ultimately resulted in the 2022 breach, presenting a grave risk to thousands of lives and a cost to the taxpayer running into hundreds of millions of pounds, at least.

“I take no pleasure as chair of this committee in stating now that we lack confidence in the MoD’s current ability to prevent such an incident happening again.”

The committee also rebuked the MoD for blocking it and the National Audit Office (NAO) from scrutinising the data loss.

Sir Geoffrey said: “The frankly chaotic decision to tell a single director within the NAO that there was a secret matter that could not be shared, without informing the leadership of the NAO itself, is emblematic of the quality of the MoD’s decision-making.

“The MoD’s outgoing permanent secretary told our inquiry that this period of secrecy in how taxpayers’ money was being spent had been ‘deeply uncomfortable’ for him.

“That is just as it should be, and we are glad to hear it – but as a consequence of elected representatives being prevented from holding government to account, it is not nearly sufficient, and he should never have been put in such a position by his minister.”

An MoD spokesperson said: “The data incident under the previous government in 2022 should never have happened and while the committee acknowledges that practices have improved, we are continuing to make changes and improvements in data handling across the department, such as introducing a dedicated, secure casework system for Afghan resettlement.

“This Government lifted the superinjunction in July so that the public and Parliament could rightly scrutinise this.

“The overall financial cost has never been concealed, and the Government published the cost of all Afghan resettlement schemes, including the ARR, in the spending audit in July 2024. We continue to estimate that the overall cost of the ARR scheme will be £850 million.”