Afghan data breach timeline: The fallout behind the scenes

The details of a massive data breach by the British military over Afghan nationals have come out this week. But behind the scenes, the fallout has been ongoing for years.

It's been three years since an unnamed official accidentally shared emails with the names and other details of 18,714 Afghan nationals who were applying for a British government relocation scheme in 2022.

The scheme was to provide asylum for people who had worked with the UK armed forces in the war against the Taliban between 2001 and 2021.

The blunder was only made public on Tuesday after a super-injunction blocking the media from reporting on the breach was removed.

It's only now that the timeline of the data breach, a subsequent secret government scheme and the super-injunction can all be revealed.

Here's what the public couldn't know until now:

April 2021

The Initial scheme to relocate Afghans who helped British military during the war is launched. It was called the Afghan Relocations and Assistance Policy (ARAP).

February 2022

The unnamed British official accidentally emails details of 18,714 Afghan nationals who applied to be relocated to the UK outside of a secure government system.

He sends the email in an attempt to verify information, believing the dataset to only contain around 150 rows of information, but it actually contains around 33,000.

14 August 2023

The Ministry of Defence (MoD) discovers the leak after seeing details of the emails had been posted by a Facebook user.

UK officials send around 1,800 ARAP applicants in Pakistan a warning via WhatsApp to say their data may have been breached.

15 August 2023

James Heappey, then armed forces minister, is warned by a civilian volunteer who assists ARAP applicants that the breach may have put those on the list and their families in grave danger.

The volunteer says: "The Taliban may well now have a 33,000-long kill list - essentially provided to them by the UK government.

"If any of these families are murdered, the government will be liable."

Read more:
'Serious questions to answer' over data breach, says PM
Guide to the Afghan data breach

25 August 2023

Then defence secretary Ben Wallace applies for a court order after the MoD gets two inquiries about the breach from journalists.

1 September 2023

High Court grants a super-injunction until a hearing scheduled for 1 December, preventing the reporting of the breach, as the MoD said the government needed four months to "do everything it reasonably can to help those who might have been put at further risk".

23 November 2023

High Court judge Mr Justice Chamberlain gives private judgment saying the super-injunction is "is likely to give rise to understandable suspicion that the court's processes are being used for the purposes of censorship".

But he continues it for four more weeks, as the MoD has reiterated that the threat to those in the dataset is "grave".

18 December 2023

MoD lawyers say the risk to life due to the breach is "immensely serious". Mr Justice Chamberlain extends the super-injunction until February 2024.

19 December 2024

The Domestic and Economic Affairs committee meets and says that a new route of settlement in the UK should be offered to some individuals who were ineligible for ARAP.

At this time, it is agreed to be a targeted cohort of around 200 people and their dependents at the highest risk following the breach, and it is called the Afghanistan Response Route (ARR).

The ARR is also covered by the super-injunction.

15 February 2024

Mr Justice Chamberlain continues the super-injunction, finding a "real possibility that it is serving to protect" some of those identified on the dataset.

But he adds: "What is clear is that the government has decided to offer help to only a very small proportion of those whose lives have been endangered by the data incident and that the decisions in this regard are being taken without any opportunity for scrutiny through the media or in Parliament."

21 May 2024

Mr Justice Chamberlain rules the super-injunction should be lifted in 21 days, saying there is a "significant possibility" the Taliban already know about the dataset and that it is "fundamentally objectionable" to keep it a secret.

25-26 June 2024

The MoD challenges the decision in the Court of Appeal, which rules that the super-injunction should continue for the safety of those affected by the breach.

In a written ruling, judges Sir Geoffrey Vos, Lord Justice Singh and Lord Justice Warby say: "As the number of family members involved is several times the number of affected people, the total numbers of people who would be exposed to a risk of death or serious harm if the Taliban obtained the data is between 80,000 and 100,000."

4 July 2024

Labour wins the general election, and Sir Keir Starmer's government inherits the scheme. It keeps the super-injunction in place.

2 February 2025

A review into the data incident response reveals that the ARR's plans would mean relocating more Afghan nationals than the original scheme, and would end up costing up to £7bn.

It recommends that the defence secretary order an independent review into the breach and subsequent scheme.

19 May 2025

The High Court is told by a Manchester-based law firm that it has more than 600 potential clients who may sue the government under data protection laws.

4 July 2025

After an independent review by retired civil servant Paul Rimmer, the government tells the High Court that the super-injunction "should no longer continue".

It comes after the review found the breach was "unlikely to profoundly change the existing risk profile" of those named and that the government possibly "inadvertently added more value to the dataset" by seeking the unprecedented super-injunction.

15 July 2025

Mr Justice Chamberlain lifts the super-injunction, making the breach and scheme reportable for the first time.

It is revealed that nearly 7,000 Afghan nationals either have been or are being relocated to the UK as part of the breach reaction scheme, with the MoD saying it will cost around £850m.

It said the internal government document from February which said the cost could rise to £7bn was outdated because the government had cut the number of Afghans it would be relocating.

What happens now?

Some 5,400 Afghans who have already received invitation letters will be flown to the UK in the coming weeks. This will bring the total number of Afghans affected by the breach being relocated to the UK to 23,900.

The rest of the affected Afghans will be left behind, The Times reported.

Around 1,000 Afghans on the leaked list are preparing to sue the MoD, demanding at least £50,000 each, in a joint action led by Barings Law.

Adnan Malik, head of data protection at Barings Law, said: "This is an incredibly serious data breach, which the Ministry of Defence has repeatedly tried to hide from the British public."

Despite the government's internal review playing down the risks caused by the data breach, Mr Malik said the claimants "continue to live with the fear of reprisal against them and their families".

The Telegraph has reported that a Whitehall briefing note circulated on 4 July warned that the MoD would need to work with the government to prepare to "mitigate any risk of public disorder following the discharge of the injunction".

(c) Sky News 2025: Afghan data breach timeline: The fallout behind the scenes