More than 1,000 people take first step in legal action over Afghan data breach

More than 1,000 people have taken the first step in legal action against the Ministry of Defence (MoD) over a massive data leak that saw thousands of Afghans being secretly relocated to the UK, a law firm has said.

Barings Law said on Friday that it had sent the MoD a letter of claim earlier this month on behalf of around 1,200 people affected by the breach, which occurred in 2022 but was not made public until earlier this year due to an unprecedented superinjunction.

The dataset, containing the personal information of nearly 19,000 people who applied for the Afghan Relocations and Assistance Policy (Arap), was mistakenly released in February 2022 by a defence official.

The MoD became aware of the breach more than a year later when parts of the spreadsheet were anonymously posted in a Facebook group in August 2023, but the matter was kept hidden until the superinjunction was lifted by a High Court judge in July this year.

Barings Law said it had sent the MoD the letter ahead of a potential legal claim being filed at the High Court.

The claimants include Afghans and their family members, and Britons who work for MI6 and UK special forces, whose data was also leaked.

The MoD, which has 14 days to respond to the letter, has said it will defend against any claim.

Robert Whitehead, chairman of Barings Law, said on Friday that the letter represented the first step towards “holding the Ministry of Defence accountable” for a “catastrophic failure” to protect personal data.

He said: “The individuals affected were already at extreme risk, having applied for relocation to the UK because they feared reprisals from the Taliban.”

He continued: “We have evidence that people named on the leaked database, or those closely connected to them, have since been killed or subjected to intimidation and extortion by the Taliban, including threats made against their loved ones.

“Our clients include individuals who have managed to reach safety in the UK, as well as others who remain in Afghanistan and are still in hiding, living in constant fear.

“It was the Ministry of Defence’s responsibility to protect this information, and the consequences of that failure are profound.

“This case is expected to test new legal ground around the rights of data breach victims where the harm extends beyond financial loss to issues of personal safety and loss of life.”

Relocation 

The Arap scheme was responsible for relocating Afghan nationals who had worked for or with the UK Government and were therefore at risk of reprisals once the Taliban returned to power in Kabul in 2021.

The data breach saw the names and contact details of the Arap applicants and the names of their family members inadvertently leaked.

It resulted in the creation of a secret Afghan relocation scheme – the Afghanistan Response Route – by the previous Tory government in April 2024.

The scheme has since allowed thousands of people to be relocated to the UK at a cost of around £850 million.

The superinjunction was made at the High Court in September 2023 to reduce the risk of alerting the Taliban to the existence of the data.

It is thought to be the longest-lasting order of its kind and the first time the Government has sought such a restrictive measure against the media.

Harassment 

In June 2024, judges said that the breach had affected between 80,000 and 100,000 people, who could be at risk of harassment, torture or death if the Taliban obtained their data.

But an independent review, commissioned by the Government in January 2025, concluded in June that the dataset is “unlikely to significantly shift Taliban understanding of individuals who may be of interest to them”.

Lifting the superinjunction the following month, Mr Justice Chamberlain said it had had the effect of “completely shutting down the ordinary mechanisms of accountability which operate in a democracy”.

In November, MPs warned that the MoD had not done enough to prevent further data breaches, and that the department “knew the risks” of using “inappropriate” data systems.

An MoD spokesperson said: “As we have consistently indicated, we will robustly defend against legal action or compensation.

“The independent Rimmer Review concluded that it is highly unlikely that merely being on the spreadsheet would be grounds for an individual to be targeted, and this is the basis on which the court lifted its superinjunction.”