Someone in Whitehall knew this could happen. That’s the damning conclusion of an inquiry into one of the most serious data breaches in recent British military history, one that left Afghan nationals who had worked alongside UK forces genuinely fearing for their lives.
The inquiry found that the Ministry of Defence’s catastrophic mishandling of personal data belonging to thousands of Afghans was not a freak accident or an unforeseeable technical failure. It was, in the words of the report, entirely foreseeable. The systems were inadequate, the warnings were there, and the consequences fell on some of the most vulnerable people imaginable.
The breach, which came to light in 2021, involved the email addresses of around 250 Afghans who had applied to the UK’s Afghan Relocations and Assistance Policy scheme. The data was exposed in a single careless CC rather than BCC error, instantly identifying individuals who had worked with British forces and were already at risk from Taliban reprisals.
For context, these weren’t anonymous applicants. They were interpreters, fixers, and local staff whose association with UK forces could, and in some cases did, put targets on their backs.
The inquiry concluded that the MoD failed to implement basic data protection measures that any competent organisation handling sensitive information should have had in place.
Defence Secretary Grant Shapps apologised when the breach was first made public, but apologies don’t un-ring a bell. Several individuals named in the breach reportedly went into hiding. The psychological toll on people who had already fled war, and were trying to rebuild their lives, is difficult to overstate.
What makes this especially galling is the bureaucratic indifference that appears to have preceded it. The MoD reportedly had multiple opportunities to tighten its data handling protocols and didn’t. That’s not a glitch; that’s a pattern.
The Cabinet Office has since pledged a review of how sensitive personal data is managed across government departments, though critics have pointed out that similar pledges have been made before with little lasting change.
The real question now is whether anyone in a position of authority will actually be held accountable, or whether this inquiry will join a long shelf of reports that gathered dust while the same mistakes quietly repeated themselves elsewhere.
