In a dramatic revelation this week, the UK government confirmed that it secretly relocated thousands of Afghan nationals, including those who served alongside British forces, after a serious data breach in early 2022 compromised their safety. Defense Secretary John Healey addressed Parliament, offering a “sincere apology” and describing the incident as a profound failure of transparency and duty to former allies.
The breach occurred when a Ministry of Defence official mistakenly emailed a spreadsheet—outside government-secure systems—in February 2022. The spreadsheet contained sensitive personal details of nearly 19,000 applicants to the Afghan Relocations and Assistance Policy (Arap), which supports thousands of Afghans who assisted the UK during its military deployment in Afghanistan between 2001 and 2021. Screenshots of the data later surfaced on Facebook in August 2023, revealing that the official leak included names, contact information, email addresses, and even details of government officials involved in the resettlement process.
In response, the Conservative government at the time obtained an unprecedented “super‑injunction” from the High Court in late 2023, blocking journalists and parliamentarians from reporting the incident or acknowledging the existence of the court order. The secrecy stretched on into the following year, until Parliament finally lifted the gag this week, allowing the public and media to learn of both the breach and the covert relocation programme that followed.
Once the leak was detected, officials launched “Operation Rubific”—also referred to as the Afghanistan Response Route (ARR)—to resettle thousands of those deemed at highest risk of Taliban reprisal. Under this effort, Defence Secretary Healey confirmed that approximately 900 primary applicants, together with about 3,600 family members, have already been brought to the UK or are in transit. As many as 6,900 total individuals are expected to be relocated by the time ARR concludes, with costs estimated at around £850 million ($1.1 billion).
Beyond this programme, around 36 thousands Afghans have relocated through other official channels since the Taliban’s return to power in 2021, including more than 16,000 from Arap who were directly affected by the breach. In total, the Ministry of Defence reported relocating or planning to relocate approximately 56,100 Afghans—a scale of resettlement that carried a tab between £5.5 billion and £6 billion, with £850 million of that attributed to ARR itself.
Despite the leak’s severity, an independent review by civil servant Paul Rimmer concluded that the Taliban already had wide access to information on many at-risk individuals, and so the breach did not materially increase the danger they faced. Critics remain unconvinced, pointing to a “catastrophic” failure in data protection that has stoked fear and anxiety among exposed individuals. Lawyers representing affected Afghans have asserted that the breach may give rise to significant compensation claims, with Leigh Day and Barings Law describing it as a violation of the UK’s obligations to its allies.
Community advocates have urged the government to fully accept responsibility, offer tangible reparations, and implement stronger protective measures for those still living under Taliban control in Afghanistan and neighbouring countries.
Mr. Healey acknowledged the “deep concern” caused by the prolonged secrecy and firmly stated that no further offers of asylum would be made under this route; however, some existing commitments remain honoured for those with approved invitations. He noted that the ARR is now closed to new applicants, though outstanding cases continue to be processed.
The lifting of the super-injunction not only exposed the data incident and covert evacuation efforts, but also prompted new calls for transparency, parliamentary oversight, and an accounting of who authorised such sweeping legal restrictions in breach of democratic norms. Lawmakers and civil liberty groups have insisted that lessons must be learned to prevent similar breaches and abuses of power. With ongoing legal challenges ahead, including a potential class-action lawsuit by over 600 claimants so far—and likely many more to come—the breach stands as a stark reminder of the duty owed to those who stood with Britain in its moment of need.
