Research submitted to the UK Parliament has revealed explicit threats to life and the deaths of family members and colleagues directly linked to the Ministry of Defence's 2022 Afghan relocation scheme data breach.

Led by charity Refugee Legal Support and assisted by academics from Lancaster and York universities, of the 231 individuals affected by what may be one of the UK's most damaging data protection failures, 49 of them said family or colleagues had been killed in Afghanistan.

The [1]survey also discovered that an even greater proportion (87 percent) reported other forms of personal risks stemming from the Taliban's reaction to the leak.

[2]

Nearly 100 direct threats to respondents' own lives were reported, while 121 said their family and friends had been threatened in Afghanistan.

[3]

[4]

According to 105 of those affected, the Taliban had raided their homes, and an equal number said their families' homes were also raided.

Only 12 people said they had not experienced any of these risks, while 15 declined to respond.

Afghan breach in brief

The first Afghan resettlement breach [5]occurred in 2021 , exposing the details of 245 Afghan interpreters helping British forces in a CC'd (not BCC'd) email.

The Information Commissioner's Office [6]fined the MoD £350,000 in 2023 over it.

A second, [7]more serious breach occurred in February 2022 involving the details of around 19,000 resettlement scheme applicants, plus a few senior British officials and spies.

The MoD did not identify the leak until part of the list was published online in August 2023, presenting an immediate threat to everyone affected, especially those who were still in Taliban-controlled Afghanistan.

The Taliban were actively hunting down people who had assisted British/Western troops during the conflict.

The UK government secured a super-injunction preventing reporting of the breach.

Included in the research submitted to the Defence Committee were personal accounts from those affected, detailing the horrors that followed the email blunder.

One member of the Triple Special Forces, who is currently residing in the UK, said: "I have suffered serious harm as a result of the Afghan data breach. My personal car was taken, and our home has been searched multiple times.

[8]

"My father was brutally beaten to the point that his toenails were forcibly removed, and my parents remain under constant and serious threat. My family and I continue to face intimidation, repeated house searches, and ongoing danger to our safety."

Others said they were under constant pressure from the Taliban, questioned and threatened every day, and beatings were common.

Impact on mental health

Stress, anxiety, depression, loss of concentration and memory, and sleeplessness were the most commonly reported symptoms of mental ill-health among those affected by the data breach, according to the research.

Nearly nine in ten respondents (89 percent) reported impacts on their own as well as their families' well-being. Only 3 percent of affected individuals said they were mentally unaffected, while the remaining 8 percent said they either did not know or declined to answer.

One Afghan National Army member currently living in Afghanistan said: "The data breach has seriously impacted both my physical and mental health.

[9]

"Since learning that my personal information was compromised, I have been living in constant fear and stress. I suffer from anxiety, sleepless nights, and extreme worry for the safety of myself and my family. The threat to my life and the risk of Taliban targeting have affected my well-being and daily functioning."

For others, some of whom were resettled to the UK while their families remain in Afghanistan, the uncertainty around the safety of their loved ones is the greatest source of concern.

One Triple Special Forces member reported living in "constant fear and guilt," despite feeling personally safe now in the UK.

"The breach has become a daily source of anxiety and emotional torment. My family – who remain in Afghanistan – are terrified. They ask me every day: Are we in danger? Did you share our names, phone numbers, addresses, or photos in your emails to the UK? Could the Taliban find us because of this?

[10]UK data regulator defends decision not to investigate MoD Afghan data breach

[11]UK government dragged for incomplete security reforms after Afghan leak fallout

[12]UK's Ministry of Defence pins hopes on AI to stop the next massive email blunder

[13]Britain's Ministry of Defence fined £350K over Afghan interpreter BCC email blunder

"I try to reassure them, but I don't have answers. The uncertainty is unbearable. My younger brother constantly asks, what if they come and take us as hostages? The fear is not just from the breach itself, but from the overwhelming amount of misinformation and panic spreading on social media. Even if the breach didn't expose everything, the fake news alone is destroying their mental health."

Those who were resettled were extremely grateful, but also said the process took far too long for a situation marred by urgent danger (up to 24 months after receiving an offer letter), and their families remain under threat due to lengthy additional processes involved in relocating them too.

One said their youngest daughters and disabled brothers remain in Afghanistan despite being financially dependent on them. The process of reuniting the family has taken more than a year, with no progress on the application.

Others also reported poor treatment by agency staff who facilitated their migration and experiences of racism from Brits.

"This research lays bare the devastating human consequences of the MoD data breach," said Olivia Clarke, executive director at Refugee Legal Support. "By centering Afghan voices and documenting their experiences, it fills a critical gap in understanding the real-world impact of the breach.

"Afghans who served alongside UK forces have reported renewed threats, violent assaults, and even the killing of family members after their personal details were exposed.

"Only a minority of those affected by the data breach have been offered relocation to the UK. The UK government must invite all affected Afghans to put forward evidence of the risks following the breach of their and their families' data, and review the negative decisions of their cases."

Victoria Canning, professor of criminology at Lancaster University, said: "By centralizing the experiences of Afghans, our research shows the real human cost of the MoD data breach. As well as threats to life, killings, and house raids, the mental health toll on affected Afghans and their families is devastating.

"Many people remain in serious danger. The UK government needs to respond urgently to ensure safety, including expediting relocations and ensuring redress."

The research findings were submitted to the Defence Committee on Friday, and the full report is due to be published in November. ®

Get our [14]Tech Resources



[1] https://committees.parliament.uk/writtenevidence/149931/html/

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aQD2qhC6JDRJmtF5MO83nQAAAA8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aQD2qhC6JDRJmtF5MO83nQAAAA8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aQD2qhC6JDRJmtF5MO83nQAAAA8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://www.theregister.com/2021/09/21/mod_email_fail_afghan_interpreters_data/

[6] https://www.theregister.com/2023/12/13/mod_bcc_email_fine/

[7] https://www.theregister.com/2025/08/29/uk_government_breach_review/

[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aQD2qhC6JDRJmtF5MO83nQAAAA8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aQD2qhC6JDRJmtF5MO83nQAAAA8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[10] https://www.theregister.com/2025/10/22/ico_afghan_leak_probe/

[11] https://www.theregister.com/2025/08/29/uk_government_breach_review/

[12] https://www.theregister.com/2025/08/06/mod_taps_aussie_ai_shop/

[13] https://www.theregister.com/2023/12/13/mod_bcc_email_fine/

[14] https://whitepapers.theregister.com/