In February 2022, an employee at the Ministry of Defence sent a spreadsheet to a trusted person outside the government. It was supposed to contain the details of around 150 Afghan relocation applicants. Unfortunately, there was much more information hidden inside it.
The file included personal details relating to more than 18,500 applications.
A large number of these applicants had worked with British forces in Afghanistan. They included interpreters, local employees and members of specialist Afghan military units. Their connection to Britain meant that some of them were already in danger from the Taliban.
The MoD did not realise that the information had been leaked until August 2023, around 18 months after the email was sent. Part of the data had appeared in a Facebook group, where an anonymous user claimed to possess 33,000 lines of information from the relocation system.
This left officials with a serious problem. They did not know how many people had obtained the file or whether it had reached anyone connected to the Taliban.
A defence-intelligence assessment found that people named in the spreadsheet could be targeted if they were still living in Afghanistan. The government decided that making the breach public might increase that danger, so it asked the High Court for an injunction.
The court imposed restrictions that prevented the media from reporting the breach. The existence of the injunction was also kept secret.
Keeping the matter quiet at the beginning was understandable. The government needed to investigate the leak without drawing further attention to the information. However, the restrictions remained in place for almost two years.
During that time, the government organised a special relocation programme without the knowledge of the public or most members of Parliament. Thousands of Afghans were affected, and a considerable amount of public money was being spent, but there was almost no opportunity for normal political scrutiny.
A Defence Committee report published on 30 July 2026 found that the incident could not be explained as an isolated error by one employee. It described the breach as a "foreseeable systemic failure".
The MoD had been using unsuitable tools to process highly sensitive information. Training and working procedures were poor, while responsibility for protecting the data was unclear. There had also been previous incidents involving Afghan applicants' information.
This should have led to tighter controls before the 2022 breach occurred.
The report also examined the treatment of former members of two specialist Afghan units known as the Triples. These units had worked alongside British troops, with some members supporting UK Special Forces.
Many of their applications to move to Britain were rejected. During one attempt to deal with a backlog, 1,585 cases were referred to UK Special Forces and apparently none was approved.
A later review reached a very different conclusion. It found that 884 former members of the Triples had been refused incorrectly.
One reason was that the officials assessing the applications did not have access to all the relevant evidence. Records held by the British government could have helped confirm that some of the applicants had worked with UK forces, but those records were not properly considered when the decisions were made.
For the people involved, this meant more than receiving an incorrect letter. Some remained in Afghanistan for years while their cases were reconsidered. Evidence given to the committee described families selling their belongings to survive and children going without proper food or medical treatment.
Some approved applicants who remain in Afghanistan may have to travel to another country before the Home Office completes its checks. Finding the money and a safe route to do that will not be easy.
The question of responsibility has still not been properly settled.
The committee did not concentrate on identifying the employee who sent the spreadsheet. It wanted to know who had been responsible for the system and whether senior officials had faced any consequences.
General Sir Gwyn Jenkins told the committee that he had not considered resigning because he did not believe he was responsible for the breach.
This leaves an uncomfortable gap between an official finding of systemic failure and the apparent absence of personal accountability at the top of the organisation.
By the middle of 2026, fewer than 9,000 eligible people were still waiting to relocate to Britain. Many of them were thought to be in Afghanistan, where the danger created by the breach was greatest.
The government has helped many Afghan families reach safety, and that part of the story should not be ignored. Officials were dealing with a difficult situation following the sudden return of the Taliban.
Nevertheless, Britain had made a clear commitment to the Afghans who helped its armed forces. Their work placed them and their families in danger.
The government had a duty to protect their information and to make fair decisions about their applications. In too many cases, it failed to do either.