No tracking. No cookies
Subscriptions
Subscriptions
Read our Monthly Magazine
And support our mission to provide fearless stories about and outside the media system
When Hikmatullah first heard about the Afghan data leak, it all, very suddenly, made sense. His brother had recently been taken prisoner by the Taliban and badly beaten. When he was finally released, after several weeks, he was unable to walk, his back broken in three places.
“He was punished because of my work,” Hikmatuallah said by phone. “Now he is just stuck in Afghanistan with no way out. The British Government don’t do anything. The impact on us has been severe.”
For more than a decade, Hikmatuallah had worked as an interpreter for the British military, before moving to the Presidential Palace as a personal bodyguard for President Karzai and later, President Ashraf Ghani. In August 2021, following the Taliban takeover, he was prioritised for a visa to travel to the UK with his wife and children. He left behind his father and his brother, a civil engineer for the International Security Assistance Force (ISAF).
In July 2025, when the Government’s unprecedented data leak became public knowledge, Hikmatullah checked on the portal to see if his data had been breached. Confirming that it had, came as both a shock and a moment of clarity. He hoped that the UK Government would now be forced to bring his remaining family to safety in Britain. No such support was forthcoming and his brother remains in Afghanistan in hiding, in fear for his life.
The Full Cost of the Ministry of Defence Afghan Data Leak Will Be Much Higher Than the Government Claimed
The breach, under the last Conservative Government, put the lives of thousands of Afghans at risk, while costing taxpayers hundreds of millions of pounds
More than 18,714 people were affected by the February 2022 data leak, including thousands who had worked with or alongside the British military and Government. The data breach was not revealed to those affected until August 2023 – and, as in the case of Hikmatullah, until the High Court lifted a super-injunction it had imposed to keep the leak a secret.
The super-injunction was finally lifted on 15 July 2025, with Defence Secretary John Healey announcing that the Conservative Government had also been running a covert resettlement scheme to evacuate those most at risk of reprisal from the Taliban. The Afghanistan Response Route (ARR) is estimated to have cost the British taxpayer at least £850 million. This does not include legal costs, or the potential cost of future compensation claims against the department from affected individuals.
The Ministry of Defence later disclosed that it had experienced 49 data breaches at the unit handling applications from Afghan citizens by August 2025, seven of which reached the threshold for reporting to the Information Commissioner’s Office (ICO).
An independent review commissioned into what had gone wrong included interviews with some Afghans resettled in the UK, but few efforts were made to invite or consider the experiences of those whose data was compromised.
The first study to reveal the impact of the data leaks has been shared with the Byline Times. It shows that physical harms, including killings, torture and harassment, are widespread among Afghans still in Afghanistan and the loved ones of those who have fled.
Of the 350 respondents who took part in the study, 87% of Afghans whose data was leaked have faced personal risks or threats to life. Among them, 28 people reported that a family member in Afghanistan had been killed because of the data breach. A further 21 reported that a colleague had been murdered due to the leaks.
In addition, at the time of the revelations in July 2025, Healey confirmed that 600 people who had been put at high risk remained in Afghanistan and had received assurances of immediate evacuation. Despite the Conservative Government’s promises, not one Afghan has been assisted to move from Afghanistan to Pakistan. There was no evidence that the Ministry of Defence followed up with any of those still in Afghanistan or offered local risk management.
Meanwhile, Afghans left behind in the country, and those in the UK with family members still in Afghanistan, face reprisals from the Taliban, with many still in hiding in fear of their lives.
“I have suffered many losses,” said one former interpreter for the British Government. “My brother was killed, my house and property were destroyed, and my wife was shot by the Taliban, leaving her disabled. Following the recent data leak, the Taliban searched my family home and continued to threaten my relatives. One of my family members is still under their pressure, and they question my family about me every day.”
Another man, who previously fought alongside the British military, said: “My son suffered significant head injuries when he was captured and tortured and he is disabled by ongoing psychological and physical difficulties as a result. He and his very young family remain in hiding and in great poverty, five hours from health care, due to the risk posed to them.”
Alongside deaths, torture and harassment, respondents to the study described the gendered impacts, with risks to men and boys including military targeting and young girls at increased risk of forced marriage due to surveillance and home searches by the Taliban. Access to education for all children has been limited following the data breach.
The Ministry of Defence estimates that up to 27,278 people affected by the leak could be resettled in the UK. So far, 3,383 people have arrived in the UK under the covert Afghanistan Response Route.
The remaining two resettlement schemes for Afghans – the Afghan Relocations and Assistance Policy (ARAP) and the Afghan Citizens Resettlement Scheme (ACRS) were both closed to new applicants on 1 July 2025. No other route to resettlement is open to Afghans seeking to evacuate to Britain.
ENJOYING THIS ARTICLE? HELP US TO PRODUCE MORE
Receive the monthly Byline Times newspaper and help to support fearless, independent journalism that breaks stories, shapes the agenda and holds power to account.
We’re not funded by a billionaire oligarch or an offshore hedge-fund. We rely on our readers to fund our journalism. If you like what we do, please subscribe.
The majority (49%) of respondents to the study said the Ministry of Defence had been “unhelpful” or they were unfamiliar with the security advice provided. One man said the information from the British Government was “very general and limited”.
He added: “They only advised me not to answer calls from unknown numbers and to secure my emails. These instructions were insufficient given the serious threats and risks I faced, including my house being searched, my brothers being summoned by intelligence services, and direct threats to our lives. Such general advice did not provide any practical help to protect my situation.”
There was no evidence from any of the respondents that the Government had offered local risk management or follow-up with individuals affected by the data breach.
A November 2025 report by the Public Accounts Committee highlighted the Ministry of Defence’s inadequate systems and failure to learn from previous breaches. The PAC said that the department had “not given us confidence that sufficient action has yet been taken” to avoid a similar leak from occurring again.
Afghans in neighbouring countries, including Iran, Pakistan and Turkey face limited to no legal protection, with many subjected to deportations and restricted access to health and psychosocial services. Legal advisors say that their precarious status – with many Afghans undocumented in neighbouring countries – leaves this group at heightened risk of harassment, exploitation and a deterioration in their mental health.
Afghans are unable to travel legally without international assistance, often placing them in the hands of smugglers. The Afghan passport was recently ranked globally as the lowest in power of all passports. Embassies are closed for citizens to obtain legal travel documentation.
Shamim Sarabi, Community Engagement and Research Lead at Refugee Legal Support, said: “These individuals were already at serious risk of persecution by the Taliban because of their links to the UK. The data breach has escalated that danger dramatically, leaving families exposed to retaliation, persecution and, in some cases, life-threatening consequences. The impact goes far beyond immediate security concerns. It has severely damaged mental health and seriously undermined trust in the systems that were meant to protect some of the most vulnerable.”
Sara de Jong, the report co-author and Professor of Politics and International Relations at the University of York, said: “Our report is the first to document the lived impacts of the Afghan data breach to those affected. These are Afghans who stood by the British, who reported attacks, threats, mental anguish and diminished trust in the UK Government. It’s already been more than 6 months since the Government finally lifted the secrecy of the breach. All that time there has been no assisted movement out of Afghanistan.”
De Jong and colleagues are now calling on the Government to honour the resettlement promise to those 600 Afghans left behind, to expedite outstanding applicants for those affected by the breach and to urgently bring them to safety. They would also like to see a review of the applications of affected Afghans who received negative decisions.
A spokesperson for the MOD said: “We are committed to honouring the UK’s pledge to Afghans who have been deemed eligible under ARP to relocate to the UK.
“The independent Rimmer Review was clear that it is unlikely that those impacted by the data incident are at an increased risk of targeting purely as a result of being on the dataset. We believe we have taken appropriate action in line with the level of risk these individuals faced.”