The UK government quietly launched a classified Afghan resettlement program after a serious data breach exposed the personal information of nearly 19,000 Afghans seeking refuge following the Taliban’s return to power.

The breach occurred in February 2022, when a Ministry of Defence (MoD) official mistakenly emailed a spreadsheet containing names, contact details, and family information of applicants to the Afghan Relocations and Assistance Policy (ARAP) program outside official government systems. However, it wasn’t until August 2023 that the MoD discovered the breach—and nine months later, a new secret relocation scheme was established.

Known internally as the Afghan Relocation Route, the program has so far helped resettle around 4,500 Afghans in the UK. Another 600 individuals and their immediate families are still waiting to arrive. The existence of the scheme and the breach was kept under wraps for over three years due to a superinjunction, which barred the media and public from discussing the case.

The details were made public on Tuesday, following a High Court ruling by Mr Justice Chamberlain that lifted the gag order. The judge warned that the injunction had created a “scrutiny vacuum,” hindering public accountability and raising concerns over press freedom.

The UK government confirmed:

• The program has cost approximately £400 million, with a projected additional £400–450 million in future expenses.
• While the scheme is now being phased out, all existing relocation promises will be honoured.
• Those affected by the data breach were only notified on Tuesday.
• An MoD investigation found it was “highly unlikely” that any individual was targeted solely because of the leak.

Defence Secretary John Healey delivered a formal apology in Parliament, describing the breach as a “serious departmental error” and “deeply regrettable.” He confirmed that the spreadsheet had surfaced on Facebook, raising fears that Taliban-linked actors may have accessed it.

“This leak is one of many data losses that occurred during the Afghanistan evacuation,” Healey said, adding that it involved senior officials, MPs, and military personnel as well.

Despite the scale of the breach, the Metropolitan Police decided not to pursue a criminal investigation. Healey also revealed that the secret relocation program had been judged by an independent review as a significant intervention, given the scale of potential harm.

In a message to those affected, the MoD urged caution—advising individuals to take steps to secure their online presence and avoid engagement with unknown contacts.

The incident traces back to the chaotic withdrawal of U.S. and allied forces from Afghanistan in August 2021, which led to the rapid collapse of the Afghan government and a swift Taliban takeover. In response, the UK launched the ARAP scheme to evacuate Afghans who had supported British efforts and now faced retribution.

The 2022 Foreign Affairs Committee had already branded the UK’s initial evacuation efforts a “disaster” and a “betrayal.” The newly revealed data breach and secret scheme have only intensified public scrutiny.

Shadow defence minister James Cartlidge admitted the breach was a “serious failure,” while lawyer Erin Alcock of Leigh Day, representing hundreds of affected applicants, described it as a “catastrophic failure of data protection and human responsibility.”