A devastating Ministry of Defence (MoD) data breach that exposed the details of thousands of Afghans seeking sanctuary in the UK could happen again, MPs have warned. The cross-party public accounts committee (PAC) published a damning report on Friday, finding that the MoD failed to learn from multiple data breaches over successive years and lacked adequate systems to manage personal data.
The February 2022 breach occurred when a spreadsheet containing 33,000 lines of data was emailed to someone outside government. It was only discovered in August 2023, when parts of the database appeared in a Facebook group, prompting the government to use an unprecedented superinjunction to halt reporting and triggering a huge secret evacuation programme. The PAC report reveals that the MoD failed to tell the National Audit Office (NAO) about the breach, despite pledging billions of pounds of taxpayers' money to the secret evacuation scheme.
Sir Geoffrey Clifton-Brown MP, chair of the PAC, said: 'The MoD knew what it was doing – it knew the risks of using inadequate systems to handle sensitive personal information as the security environment in Afghanistan deteriorated. We lack confidence in the MoD’s current ability to prevent such an incident happening again.' He criticised the 'frankly chaotic decision' to tell a single NAO director about a secret matter without informing the leadership.
An independent caseworker who first alerted the government to the data loss in 2023 described the report as 'excoriating', adding: 'It shows that there has been an ongoing and continuing priority given to limiting the MoD’s accountability... Thousands of people are still in danger in Afghanistan and yet the evacuation pathway is currently at a standstill.'
An MoD spokesperson said the data incident 'should never have happened' and that practices have improved, including introducing a dedicated secure casework system for Afghan resettlement. The spokesperson added that the government lifted the superinjunction in July to allow public scrutiny.
