The Afghan data breach has already cost millions. What happens next?

Times

16-07-2025

The fallout from the Afghan data breach will have ripples across the world.
People named on a leaked dataset that officials feared could become a Taliban 'kill list' must make life or death decisions: whether to move house or, for those who may have already left the country, whether to send their families running.
At least 18,500 Afghans have already been secretly flown to Britain and more are expected to arrive in the coming days.
Back in the UK, the government is having to grapple with the issues of accommodation for the Afghans whose lives they put in danger more than three years ago, in February 2022, when their data was leaked in a massive blunder.
A flurry of legal action is expected as dozens of judicial reviews involving Afghans who have been blocked from coming to the UK are upended, law firms seek compensation for those affected and previously rejected applicants launch appeals.
Here is what to expect next:
Untested system costing £360,000 a month
All of those Afghans affected by the data breach should have been sent proactive notifications to tell them they were among the victims, although the Ministry of Defence (MoD) may be relying on out-of-date information.
An information service centre will also be established to notify individuals affected by the incident. Inquiries around the world will be directed here. The service, which costs £360,000 a month, has never been tested at scale before.
It will provide advice on what has happened and how individuals can take actions to protect themselves. A follow-up notification will then be sent advising them what to do next.
The centre will provide an online self-checker capability; a reactive email service aimed at individuals both in the UK and abroad who are concerned they or their family members are affected. There will also be an automated telephone capability plus a 'limited' call-handling service, which costs £30,000 a month.
•
Those answering the phones will not be able to tell those calling whether they have been affected or not. Calls will be taken in English only and calls from Afghanistan are discouraged.
According to a government plan for 'break glass' — the moment news of the data breach is revealed — prepared in the weeks leading up to the lifting of the superinjunction, 'there remains a risk that we incorrectly email unaffected persons and the self-checker wrongly informs persons if they are likely to be affected or not'.
More than 3,000 principal applicants on the list — plus their family members, taking the total to about 18,500 — have so far been allowed to come to Britain under the secret Afghan Response Route, which has been shut down.
More than 5,000 more Afghans affected by the breach who have received invitation letters already to come to the UK will be flown to Britain. This will take the total to almost 24,000 Afghans affected by the breach being brought to the UK. The remaining affected Afghans — potentially 76,000 people when taking into account family members — will not be allowed to come as the three Afghan schemes have been shut down.
A gigantic lawsuit and 'substantial payments'
Hundreds of Afghans all over the world are in the process of launching a claim against the government for leaking their personal data as part of a massive lawsuit that could end up costing taxpayers more than £250 million.
The lawsuit is being prepared by Barings Law, a Manchester-based firm that had already signed up some 1,000 clients while the superinjunction remained in place, even though the individuals did not know why they were agreeing to take legal action.
Adnan Malik, head of data protection at Barings Law, told The Times his clients had suffered 'real and ongoing harm' and 'live with the fear of reprisal against them and their families, when they were owed a duty of care for their dangerous work'.
'We would expect substantial financial payments totalling five figures for each claimant,' he said. 'While this will not fully redress the harm they have been exposed to, it will enable them to move forward and rebuild their lives.'
Thousands more Afghans are likely to join the legal fight for compensation once they are able to determine whether or not their name is on a 19,000-strong list of principal individuals whose data was breached in February 2022. About 19,000 applicants were on the list, but the MoD feared as many as 100,000 individuals were put at risk by the leak when taking into account family members.
Each Afghan could end up with at least £50,000 each and Barings believes they could have as many as 5,000 clients in the coming months. Thousands of family members may also be able to claim compensation because their names were on the list, which included phone numbers and addresses.
Malik said the leak was an 'incredibly serious breach which the MoD has tried to hide from the British public … It involved the loss of personal, identifying information about Afghan nationals who have helped British forces to defeat terrorism and to support security and stability in the region.
'By allowing their information to be leaked, the MoD has put multiple lives at risk, damaged its own reputation and put the success of future efforts in jeopardy by diminishing trust in its data security protocols.'
Malik said the 'lifting of a superinjunction which kept this data breach a secret is crucial in exposing the failings so that lessons can be learnt'.
Those Afghans suing the MoD are in the UK, Afghanistan, America, Turkey and Australia, as well as African nations. Until now the law firm had been unable to tell their clients why exactly they may be owed compensation without breaching the superinjunction.
Messages circulated on WhatsApp groups urging Afghans to sign up to the legal case on the expectation they would be given huge sums of money, without knowing the true extent of why.
Housing strain over rescued Afghans
Thousands of hotel rooms are being earmarked for new Afghan residents as councils 'creak under the pressure' of having to find houses for them alongside British citizens and an influx of refugees, court documents have disclosed.
Rachel Reeves, the chancellor, announced a pledge to stop using hotels to accommodate asylum seekers by the end of the current parliament — expected in 2029 — as part of her spending review last month. But the government is likely to increasingly rely on hotels as hundreds of vulnerable Afghans a month are rescued from the clutches of the Taliban.
Behind the scenes, 2,200 beds have been made ready at three hotels and a pilot site to make way. More than 1,000 rooms on MoD bases are being taken up by rescued Afghans and at one point 20 per cent of the defence estate was being used to house them.
By September, the government will have run out of 'transitional' accommodation in the form of hotels, serviced accommodation and pilot projects already available, documents released to the court state, raising questions about where all the Afghans will go.
One Afghan in a family of four will cost taxpayers about £1.25 million over three years if they are put into MoD transitional accommodation, including a hotel.
It costs half that amount if social housing is found for them instead, according to government figures, but officials have pointed out local government is 'creaking under current pressures' and in March 2023 there were 1.29 million households on social housing waiting lists.
At one point the problem with finding room for the Afghans was deemed so severe that officials asked ministers to consider asking foreign governments, including the US, to see if they would take them. Officials under the previous Conservative government debated the costs for what was described as a 'Rwanda-style' scheme.
The Afghans who are being rescued are not asylum seekers, having come to the UK legally and been given indefinite leave to remain.
Misinformation and threat of riots
The government has been concerned about the impact on public disorder of the data breach and its handling of it. This is especially so given the superinjunction has been lifted in the summer, when the risk of unrest is deemed to be higher.
Court documents disclosed how MoD officials discussed ways to 'provide cover' for the numbers of Afghans arriving last year. Rather than announce there would be large numbers of future arrivals, the government agreed to put out an 'agreed narrative that provides context for the increased numbers without disclosing information relating to the incident'.
However, their arrival in large numbers — at a time the real reason why many had been rescued was covered up — has been linked to unrest in the UK.
CHRISTOPHER FURLONG/GETTY IMAGES
In May, Bracknell Forest council responded to 'misinformation circulating regarding our new Afghan families' after a rumoured assault on a girl that turned out to be fake. After a Facebook user posted in multiple groups their daughter had been attacked the council issued a statement that 'we want to make sure all our residents have the facts' and that it 'would like to reiterate that our new families are not illegal immigrants, asylum seekers or refugees'.
'They have indefinite leave to remain and so are now UK residents,' it added. 'The new families are part of the national Afghan Resettlement Programme, which offers relocation and resettlement to Afghan citizens, and their immediate family, who worked for or with the UK government to support the UK mission in Afghanistan [and] are considered vulnerable or in danger from the Taliban.'
MoD documents also referred to the summer riots of 2024, in which asylum seekers and Muslims were targeted, and which were described by officials as 'the worst outbreak of racial violence in the UK for decades'.
Officials noted that 15 of the 20 primary disorder hotspots were in the top 20 per cent of local authorities with high numbers of supported asylum seekers and Afghan resettlement arrivals. They said that 'this underlines the importance of mainstreaming community cohesion considerations throughout our resettlement approach'.