A cyber-attack on a contractor linked to the UK Ministry of Defence has exposed the personal data of up to 3,700 individuals, including Afghans involved in a resettlement programme. The breach at Inflite The Jet Centre Ltd, which provides ground services for defence and Cabinet Office flights, compromised data of those who flew into London Stansted Airport between January and March 2024.
The affected individuals include Afghans seeking refuge under the Afghan Relocations and Assistance Policy, as well as civil servants, soldiers on routine exercises, and journalists. Inflite confirmed the breach involved “access to a limited number of company emails” and has reported the incident to the Information Commissioner’s Office. It is working with the National Crime Agency and the National Cyber Security Centre on the investigation.
A government spokesperson stated that a third-party sub-contractor experienced a cybersecurity incident involving unauthorised access to a small number of emails containing basic personal information. They emphasised that the incident posed no threat to individuals’ safety and did not compromise government systems. The data is not believed to have been leaked to the dark web or made public.
This breach follows a separate incident in February 2022, when a defence official disclosed the personal data of 18,714 Afghans who had worked with British forces. The Labour defence secretary later apologised for that breach, for which the Conservative government had obtained a superinjunction.
