Afghan Data Breach: The Timeline

In what has been described as the worst data breach in British history, the personal details of thousands of Afghan nationals who supported British forces during the conflict in Afghanistan were exposed. These individuals, many of whom had already fled their country in fear of Taliban retaliation, suddenly found their identities at risk following a catastrophic lapse in data security by the Ministry of Defence.

On July 15, a super-injunction that had previously kept the details of the breach confidential was lifted, bringing the scandal into the public domain. The breach has sparked widespread concern and criticism, as many of those affected now face renewed threats to their safety. We’ve compiled a timeline of key events leading up to the breach, the imposition of the super-injunction and its eventual lifting to provide a clear picture of how this tragedy unfolded.

April 2021

The Initial scheme to relocate Afghans who helped British military during the war is launched. It was called the Afghan Relocations and Assistance Policy (ARAP).

February 2022

An unnamed British official accidentally emails details of 18,714 Afghan nationals who applied to be relocated to the UK outside of a secure government system.

He sends the email in an attempt to verify information, believing the dataset to only contain around 150 rows of information, but it actually contains around 33,000.

14 August 2023

The Ministry of Defence (MoD) discovers the leak after seeing details of the emails had been posted by a Facebook user.

UK officials send around 1,800 ARAP applicants in Pakistan a warning via WhatsApp to say their data may have been breached.

15 August 2023

James Heappey, then armed forces minister, is warned by a civilian volunteer who assists ARAP applicants that the breach may have put those on the list and their families in grave danger.

The volunteer says: “The Taliban may well now have a 33,000-long kill list – essentially provided to them by the UK government.

“If any of these families are murdered, the government will be liable.”

25 August 2023

Then defence secretary Ben Wallace applies for a court order after the MoD gets two inquiries about the breach from journalists.

1 September 2023

High Court grants a super-injunction until a hearing scheduled for 1 December, preventing the reporting of the breach, as the MoD said the government needed four months to “do everything it reasonably can to help those who might have been put at further risk”.

23 November 2023

High Court judge Mr Justice Chamberlain gives private judgment saying the super-injunction “is likely to give rise to understandable suspicion that the court’s processes are being used for the purposes of censorship”.

But he continues it for four more weeks, as the MoD has reiterated that the threat to those in the dataset is “grave”.

18 December 2023

MoD lawyers say the risk to life due to the breach is “immensely serious”. Mr Justice Chamberlain extends the super-injunction until February 2024.

19 December 2024

The Domestic and Economic Affairs committee meets and says that a new route of settlement in the UK should be offered to some individuals who were ineligible for ARAP.

At this time, it is agreed to be a targeted cohort of around 200 people and their dependents at the highest risk following the breach, and it is called the Afghanistan Response Route (ARR).

The ARR is also covered by the super-injunction.

15 February 2024

Mr Justice Chamberlain continues the super-injunction, finding a “real possibility that it is serving to protect” some of those identified on the dataset.

But he adds: “What is clear is that the government has decided to offer help to only a very small proportion of those whose lives have been endangered by the data incident and that the decisions in this regard are being taken without any opportunity for scrutiny through the media or in Parliament.”

April 2024

A new resettlement scheme – The Afghanistan Response Route – is set up for those on the leaked list.

21 May 2024

Mr Justice Chamberlain rules the super-injunction should be lifted in 21 days, saying there is a “significant possibility” the Taliban already know about the dataset and that it is “fundamentally objectionable” to keep it a secret.

25-26 June 2024

The MoD challenges the decision in the Court of Appeal, which rules that the super-injunction should continue for the safety of those affected by the breach.

In a written ruling, judges Sir Geoffrey Vos, Lord Justice Singh and Lord Justice Warby say: “As the number of family members involved is several times the number of affected people, the total numbers of people who would be exposed to a risk of death or serious harm if the Taliban obtained the data is between 80,000 and 100,000.”

4 July 2024

Labour wins the general election, and Sir Keir Starmer’s government inherits the scheme. It keeps the super-injunction in place.

2 February 2025

A review into the data incident response reveals that the ARR’s plans would mean relocating more Afghan nationals than the original scheme and would end up costing up to £7bn.

It recommends that the defence secretary order an independent review into the breach and subsequent scheme.19 May 2025

The High Court is told by a Manchester-based law firm that it has more than 600 potential clients who may sue the government under data protection laws.

4 July 2025

After an independent review by retired civil servant Paul Rimmer, the government tells the High Court that the super-injunction “should no longer continue”.

It comes after the review found the breach was “unlikely to profoundly change the existing risk profile” of those named and that the government possibly “inadvertently added more value to the dataset” by seeking the unprecedented super-injunction.

15 July 2025

Mr Justice Chamberlain lifts the super-injunction, making the breach and scheme reportable for the first time.

It is revealed that nearly 7,000 Afghan nationals either have been or are being relocated to the UK as part of the breach reaction scheme, with the MoD saying it will cost around £850m.

It said the internal government document from February which said the cost could rise to £7bn was outdated because the government had cut the number of Afghans it would be relocating.

17 July 2025

It is revealed that more than 100 British officials’ details were leaked alongside Afghan nationals. This includes members of the UK special forces, MI6 spies and intelligence officers, senior military personnel and government officials.

21 July 2025

Parliament’s intelligence watchdog announces it will launch an inquiry into the data breach. The intelligence and Security committee (ISC), which routinely reviews sensitive material, was not informed of the data breach until the super-injunction was lifted.

The fallout from the breach has been devastating. Many of the affected Afghan nationals now live in constant fear, worried their association with British forces could make them a target for Taliban reprisals. The incident has raised serious questions about the UK government’s ability to protect those who risked their lives in service to British mission overseas.

In response to the growing outcry, the government has indicated that it will now be relocating many of those affected to the UK to ensure their safety. But for many, this comes too late to the damage already done.

At Barings Law, we are representing almost 1,000 Afghan nationals and British service personnel affected by this breach. We believe this was a catastrophic failure to uphold the duty of care owed to individuals who placed their trust in the Ministry of Defence and UK government.

If you have been affected by the breach, you may be entitled to compensation. We want to hold those responsible to account and believe those affected deserve answers, redress and the opportunity to rebuild their life without fear.

You can submit your claim by clicking on the button at the bottom of this page. Our team will work with you to ensure justice is served.