The Ministry of Defence (MoD) has fallen below the standards that the public and Parliament should expect in the handling of sensitive personal information, says the House of Commons’ Public Accounts Committee. The committee of MPs has reported on the 2022 breach, which put thousands of Afghans at risk of reprisal from the Taliban, at a financial cost to the taxpayer estimated at £850m.
The MPs in a 25-page report state that behind the 2022 breach lay, instead of a casework system designed to process high volumes of personal data, the MoD inappropriately relying on Excel spreadsheets stored on a SharePoint site. The MoD first became aware of the data breach in August 2023, 18 months after it occurred, when personal details of ten individuals from the dataset were posted online on Facebook. After its discovery of the data breach, in August 2023 the MoD decided to apply to the High Court for an injunction to prevent the data loss becoming public; the so-called ‘super-injunction’, was upheld several times until 2025.
Chair’s words
Sir Geoffrey Clifton-Brown, Chair of the PAC, spoke of a ‘farrago of errors and missteps that led to, and followed, the Afghan data breach’. Sir Geoffrey, the long-serving Conservative Cotswolds MP, said: “The Ministry of Defence knew what it was doing – it knew the risks of using inadequate systems to handle sensitive personal information as the security environment in Afghanistan deteriorated. Indeed, data breaches occurred in 2021 which were sufficiently serious to have to be reported to the Information Commissioner’s Office, giving a warning which MoD should have taken steps to heed.
“These risks crystallised into dozens of data breaches over years, and ultimately resulted in the 2022 breach, presenting a grave risk to thousands of lives and a cost to the taxpayer running into hundreds of millions of pounds, at least.
“I take no pleasure as Chair of this Committee in stating now that we lack confidence in the MoD’s current ability to prevent such an incident happening again. We have now taken evidence from the MoD on what happened, and other Parliamentary Committees are also scrutinising the incident. But raking through such details after the fact is of course not how Parliamentary scrutiny ought to function.
“Our inquiry has established the chain of events which led to the PAC and the National Audit Office being blocked from doing its work on behalf of the taxpayer. The frankly chaotic decision to tell a single director within the NAO that there was a secret matter that could not be shared, without informing the leadership of the NAO itself, is emblematic of the quality of the MoD’s decision-making.
“The MoD’s outgoing Permanent Secretary told our inquiry that this period of secrecy in how taxpayers’ money was being spent had been “deeply uncomfortable” for him. That is just as it should be, and we are glad to hear it – but as a consequence of elected representatives being prevented from holding government to account, it is not nearly sufficient, and he should never have been put in such a position by his minister.
Sir Geoffrey added that the committee would continue to seek formal arrangements to allow proper scrutiny of sensitive defence spending, so that no Permanent Secretary would ever have to face such a situation again.
ICO view
The data protection watchdog the ICO said in July that it has been supporting and overseeing the Ministry of Defence’s (MoD) internal investigation into what the regulator called ‘a deeply regrettable incident’ from 2022; and that it was reassured that the MoD’s investigation has resulted in taking necessary steps and minimised the risk of this happening again.
Background
The report quoted MoD estimates that up to 27,278 people affected by the breach could be resettled in the UK; 3,383 people had arrived in the UK under the ARR by June 2025, according to the Home Office. The PAC has asked for a six-monthly update on resettlement activity through the ARR, as well as for assurance that costs relating to the scheme will be captured accurately. The report stated that a proposal for a Parliamentary oversight committee looking at more sensitive aspects of defence work, particularly defence and the nuclear, was moving far too slowly.
Photo: MoD, London, by Mark Rowe
