Afghans heroes vulnerable to more data leaks, say MPs

A devastating Ministry of Defence (MoD) data breach that exposed the details of thousands of Afghans seeking sanctuary in the UK - potentially putting up to 100,000 lives at risk - could happen again, MPs have warned.

- HOLLY BANCROFT HOME AFFAIRS CORRESPONDENT

A cross-party group of MPs that scrutinises government spending publishes a damning report today into the MoD’s response to the breach.

The public accounts committee (PAC) found the department failed to learn from multiple data breaches over successive years and there were inadequate systems and controls in place at the MoD to manage personal data.

The February 2022 breach occurred when a spreadsheet containing 33,000 lines of data was emailed to someone outside government. It was only discovered in August 2023, when parts of the database appeared in a Facebook group. This prompted the government to use an unprecedented superinjunction to halt reporting and triggered a huge secret evacuation programme.

For nearly two years, media organisations, including The Independent, sought to scrutinise the MoD’s actions in secret court hearings. The PAC report reveals that the MoD failed to tell the National Audit Office (NAO) about what had happened, despite pledging billions of pounds of taxpayers’ money to the secret evacuation scheme behind closed doors.

One audit director at the NAO was told by the MoD that there was a secret matter relating to a data breach that could not be shared, the report said. They were not told any detail of the operational consequences, number of people affected, or likely cost. The director was also told they could not pass on this information to anyone else within the spending watchdog.

At one point in October 2024, ministers signed off on a £7bn scheme to move around 36,000 people to the UK, a significant majority of whom were affected by the data breach.