The British government formally apologized on Tuesday for a major data breach that exposed the personal information of more than 18,000 Afghan nationals who had applied for relocation to the United Kingdom under programs meant to protect those who aided British forces in Afghanistan.
John Healey, the UK’s newly appointed defense secretary, told Parliament that in February 2022, a Ministry of Defense official mistakenly emailed a file containing sensitive information — including full names, contact details and, in some cases, family data — outside secure government systems. The individuals affected had applied through the Afghan Relocations and Assistance Policy (ARAP).
British officials have described the incident as one of the most serious immigration-related data breaches in the country’s recent history. Some of the records also included names of British military officers and Members of Parliament who had endorsed applicants, raising security concerns for both Afghan nationals and their sponsors.
“This may have happened under the previous government, but on behalf of the UK government, I sincerely apologize to everyone whose data was exposed,” Healey said.
The breach, which occurred under the previous administration, was kept from the public for nearly two years under a sweeping gag order known as a superinjunction — a rare legal measure that prohibited even the acknowledgment of its existence. The order remained in effect for 683 days and was lifted only after a legal challenge by The Times of London.
Critics say the superinjunction, originally justified on national security grounds, became a means of avoiding political accountability. “Parliament was blinded,” Mr. Healey admitted. “There was no scrutiny, and no chance for oversight on an issue of urgent public concern.”
The government eventually launched a new pathway called the Afghan Relocation and Resettlement (ARR) route for individuals placed at risk by the breach but who did not qualify under ARAP. Initially designed for 200 people, the ARR scheme ultimately covered more than 3,000.
To date, about 900 individuals have arrived in the UK through this expanded channel, along with 3,600 of their family members — at an estimated cost of £400 million. Healey announced that the ARAP program will no longer accept new applications, citing cost, limited risk to some applicants, and a lack of transparency in previous assessments.
However, he said existing invitations for relocation would still be honored.
Amnesty International UK called the breach “deeply troubling.” Steve Valdez-Symonds, the organization’s director for refugee and migrant rights, said the case “raises urgent and serious questions about how the UK exercises its immigration powers.”
He added: “This is yet another failure in a long line of broken promises — from delays in protecting Afghan special forces to failures in reuniting families and the premature closure of relocation schemes.”
In a related move, the Ministry of Defense has launched a digital “self-check” portal for individuals to determine whether their data was part of the breach. Applicants can enter their reference number or submit a contact form online. Due to data protection laws, phone inquiries are not being accepted.
According to official figures, more than 36,000 Afghans have been relocated to the UK through the ARAP, Afghan Citizens Resettlement Scheme (ACRS), and ARR programs since the fall of Kabul in 2021.
Healey concluded his remarks by reaffirming Britain’s moral obligation to those who stood beside its forces: “These schemes cannot last forever, but our duty to those who served with us must be honored — and we must do better.”
