Afghan data breach was 'farrago of errors and missteps' that could happen again, say MPs

The Afghan data breach was 'a farrago of errors and missteps' that could all too easily happen again, an inquiry by MPs has found.

In 2022, the UK lost a vital database of Afghans and UK officials, putting 100,000 people 'at risk of death'.

When the Daily Mail discovered this data breach disaster in 2023, the Government obtained a super-injunction – a draconian court order - to hush it up, triggering a 23-month battle in secret courts for open justice.

This July, the Government finally abandoned its attempt to smother the truth, and the public discovered that ministers had secretly agreed a £7billion scheme including a mass evacuation programme to rescue thousands of Afghans who had worked for British forces.

Our shocking revelations sparked four Parliamentary probes, and today senior MPs on the Public Accounts Committee warned they were 'not confident' defence officials have done enough to prevent a repeat of the disaster.

Chairman Sir Geoffrey Clifton-Brown said: 'It is the duty of this committee to report on the farrago of errors and missteps that led to, and followed, the Afghan data breach.'

The confidential database that the British government lost, putting '100,000 people at risk of death' and triggering the evacuations mission Operation Rubific

A blunder by the British government put Afghans loyal to British troops at risk of reprisal attacks by Taliban revenge squads

Hundreds of migrants file off a British taxpayer-chartered jet

The Ministry of Defence had kept the data it lost on Excel files, rather than a specialised data management system. And the disastrous breach was not the MOD's first data leak.

Sir Geoffrey said: 'The Ministry of Defence knew what it was doing - it knew the risks of using inadequate systems to handle sensitive personal information as the security environment in Afghanistan deteriorated.

'These risks crystallised into dozens of data breaches over years, and ultimately resulted in the 2022 breach, presenting a grave risk to thousands of lives and a cost to the taxpayer running into hundreds of millions of pounds, at least.

'I take no pleasure as chair of this committee in stating now that we lack confidence in the MoD's current ability to prevent such an incident happening again.'

The committee condemned the decision to keep Parliament in the dark for two years. Journalists from the Daily Mail and other media faced the threat of jail if they revealed the scandal or even that the super-injunction existed, while ministers decided not to inform any Parliamentary committees.

Even when they met in secret in October 2024, to sign off £7billion with the public neither asked nor informed, they did not tell anyone on the Public Accounts Committee, which monitors spending.

One of the unmarked planes landing at Stansted Airport carrying Afghans whose data was breached by the UK Government

How ministers signed up to a £7billion scheme to relocate Afghans to the UK, without asking or telling taxpayers or MPs. The MOD says the figure has since been revised to around £6billion

Defence chiefs told one director at the National Audit Office, the public spending watchdog, that there was 'a secret matter' but not any details the enormous public expenditure they were embarking on covertly.

Sir Geoffrey said: 'Our inquiry has established the chain of events which led to the PAC and the National Audit Office being blocked from doing its work on behalf of the taxpayer.

'The frankly chaotic decision to tell a single director within the NAO that there was a secret matter that could not be shared, without informing the leadership of the NAO itself, is emblematic of the quality of the MoD's decision-making.'

The PAC's report, published today, concludes: 'The MoD has fallen below the standards that the public and Parliament should expect in the handling of sensitive personal information, and the PAC's report calls for a full list of actions it is now taking to prevent future data breaches.'

In September, the NAO condemned defence chiefs for being unable to explain the mammoth costs of the Afghan scheme to taxpayers, concluding: 'The Ministry of Defence cannot determine exactly how much it has spent. It has not provided enough evidence to give the National Audit Office confidence.'

The NAO said the number of affected people eventually resettled in the UK could be up to 27,278 individuals - nearly four thousand more than expected.

The spending watchdog accused the MOD of failing to provide it with 'sufficient evidence' so it could be confident that figures the department provided for the cost of the fallout from the breach were accurate.

The MOD said: 'The data incident under the government in 2022 should never have happened and while the Committee acknowledges that practices have improved, we are continuing to make changes and improvements in data handling across the department, such as introducing a dedicated, secure casework system for Afghan resettlement.'

It said the 'overall financial cost has never been concealed', with the estimates for the airlift launched in response to the data leak put at £850million.