A catastrophic data breach by the Ministry of Defence (MoD) has had devastating consequences for those impacted, according to new evidence submitted to the Defence Select Committee inquiry. The study, prepared by Refugee Legal Support in partnership with academics from York and Lancaster universities, found that 49 of the 239 respondents who had their data leaked by the MoD reported that colleagues or family members had been killed as a result of the data breach. Over 50% of the respondents said that family or friends in Afghanistan had been threatened by the Taliban and 89% of those questioned said the data leak had had a profound impact on their mental health.
The breach, which took place in early 2022, occurred after an unknown individual mistakenly sent an email to an unauthorized distribution list, exposing the personal details of nearly 19,000 people who had previously worked with the UK armed forces and had applied to be relocated to the UK after the Taliban seized power in Afghanistan. The MoD only discovered the existence of the breach in August 2023 after part of the dataset was published on Facebook.
An “unprecedented” prevention of reporting
After discovery of the breach, the MoD obtained a super-injunction to prevent any reporting on either the data breach or the existence of the injunction itself. The super-injunction, later described as “unprecedented”, was finally lifted two years later in July 2025. In lifting the injunction, the presiding Judge Mr Justice Chamberlain acknowledged following a review commissioned by the MoD that “the Taliban likely already possess the key information in the dataset, that it is unlikely that individuals would be targeted simply because of their work for the UK…and that the acquisition of the dataset is accordingly unlikely substantially to raise the risk faced by the individuals whose data it includes”.
In July, it was reported by The Telegraph that more than 200 Afghan soldiers and police have been murdered by the Taliban since the breach, however it is not known whether their details appeared in the MoD list. The Taliban claims that it has been in possession of the list in 2022 and it has been hunting those identified in it since.
Despite this, defence secretary John Healy said it is “highly unlikely” that simply being named on the list would increase the risk of being targeted and he said it was on this basis the Judge was able to lift the super-injunction that has stopped any knowledge of the data breach.
The human cost of delay
According to respondents to the survey, the delay in discovery of the data breach has a detrimental impact on the ability of those affected to take safety measures.
A former Afghan National Army member responding to the survey said: “The delay between the discovery of the data breach in 2023 and the communication in July 2025 is deeply concerning and unacceptable. Waiting almost two years to inform individuals that their personal data was compromised has put many lives at risk unnecessarily. Immediate notification could have allowed us to take protective measures much earlier. This delay shows a serious lack of urgency and responsibility from the Ministry of Defence, especially considering the sensitive nature of our backgrounds and the high-risk environment we live in.”
Refugee Legal Support’s Executive Director Olivia Clark said: “This research lays bare the devastating human consequences of the MoD data breach. By centring Afghan voices and documenting their experiences, it fills a critical gap in understanding the real-world impact of the breach.”
“Only a minority of those affected by the data breach have been offered relocation to the UK. The UK Government must invite all affected Afghans to put forward evidence of the risks following the breach of their and their families’ data, and review the negative decisions of their cases.”
Claims against the Ministry of Defence
Those affected by the breach are likely to have claims for compensation against the Government for failing to keep their personal data secure, in light of the serious potential risks to their security and the distress and anxiety it has caused.
Taylor Hampton is highly experienced in representing victims of unlawful activity, including acting for a large number of individuals in a group litigation structure and on “no win, no fee” bases. Our firm has extensive expertise in acting in defamation and privacy matters. Taylor Hampton is committed to acting for individuals and victims of wrongdoing and are well placed to hold powerful organisations or public authorities to account.
If you have been affected by the data breach and wish to discuss the matter on a confidential basis, please contact Taylor Hampton at [email protected].
Disclaimer: This article provides general guidance only and does not constitute legal advice. Always seek professional legal advice tailored to your specific situation before acting.