Britain’s Ministry of Defence (MoD) is facing mounting scrutiny after a massive data breach in 2022 exposed the personal details of nearly 19,000 Afghans who had worked with or for British forces, according to a National Audit Office (NAO) report released on September 3, 2025. The breach, one of the gravest security lapses in recent British history, has triggered a costly and secretive resettlement effort, the full price tag of which remains shrouded in uncertainty.
The NAO, Britain’s public spending watchdog, revealed that the MoD cannot accurately calculate the total cost of the Afghanistan Response Route (ARR), the emergency scheme set up in April 2024 to relocate those put at risk by the leak. The watchdog’s report casts serious doubt on the government’s headline claim of £850 million for the scheme, noting that this figure excludes crucial legal fees and potential compensation claims—expenses that are expected to be substantial but remain unquantified. As reported by BBC News, the NAO stated, “The MoD is not able to determine exactly what it has spent on resettling people through the ARR scheme. This is because it did not separately identify the costs of the ARR scheme in its accounting system, meaning that these costs were not visible in its management accounts, but instead included them within its total spending on Afghan resettlement activities.”
Originally, officials believed the breach had affected around 150 people. However, as the relocation program closed in August 2025, it became clear that 7,355 Afghans, including family members, would be resettled in the UK by 2029 as a direct result of the incident. The government’s own estimates put the cost of resettling each individual at £128,000, with £53,000 of that sum borne by the MoD. Overall, the total bill for all Afghan resettlement programs is forecast to exceed £2 billion by 2029, according to The Guardian.
The leak itself occurred when an MoD official mistakenly emailed a spreadsheet containing a hidden tab with the names, contact details, and family information of thousands of Afghans who had applied to move to the UK to escape Taliban reprisals. The breach also exposed the names of British officials, including members of UK special forces, compounding the gravity of the incident. The sensitive data, comprising 33,345 lines, was later published on Facebook in 2023, but the full scale of the breach only became apparent 18 months after the initial error.
The government’s response to the crisis was shrouded in secrecy. In September 2023, the High Court granted a super injunction—an extraordinary legal measure that not only barred reporting of the data breach but also prevented disclosure of the injunction’s very existence. The MoD argued that this level of secrecy was necessary to protect the lives of those affected from Taliban retaliation. As a result, the costs of the ARR scheme were merged with other Afghan resettlement programs in government accounts, making it impossible for auditors or the public to discern the true financial impact of the breach. The super injunction was finally lifted in July 2025, after Defence Secretary John Healey issued a public apology, acknowledging the inclusion of information about lawmakers and senior military figures who had supported Afghan allies seeking refuge.
The NAO report highlighted that the government has already spent £400 million on the ARR scheme and expects to spend another £450 million in the coming years. However, the MoD’s estimate of £850 million for the scheme’s total cost is considered unreliable. “At the time of publication, the MoD had not provided us with sufficient evidence to give us confidence regarding the completeness and accuracy of these estimates,” the NAO concluded, as cited by Reuters.
Additional costs are mounting. The MoD’s legal efforts to keep the scheme secret have already cost taxpayers an extra £2.5 million in legal fees, with further expenses anticipated as the government pays defendants’ costs and eventual compensation payments to those affected. None of these legal or compensation costs were included in the £850 million estimate. Byline Times reported that the ministry’s approach to accounting—merging ARR costs with other programs—was a direct result of the need to preserve secrecy after securing the super injunction.
The fallout from the breach and the government’s handling of its aftermath has drawn criticism from across the political spectrum. Sir Geoffrey Clifton-Brown MP, Chair of the Committee of Public Accounts, remarked, “Confusion still remains over the reported £850 million historic and future costs relating to the breach, with the MoD unable to provide sufficient assurance over their numbers. This figure does not include all legal costs or compensation claims, which currently remain unknown.” The Liberal Democrats’ defence spokeswoman Helen Maguire MP went further, demanding, “Not only has the MoD put thousands of lives at risk through its bureaucratic blunders, but now it can’t even tell the British public how much taxpayer money those blunders have cost. This is exactly why we need a full inquiry.”
In response to mounting pressure, the MoD has repeatedly emphasized its commitment to transparency and to fulfilling the UK’s moral obligation to those Afghans who stood alongside British forces. An MoD spokesperson told The Guardian, “We are committed to honouring the moral obligation we owe to those Afghans who stood with us and risked their lives. Since taking the decision to support the lifting of the super injunction brought by the previous government, we have been clear on the costs associated with relocating eligible Afghans to the UK – and are fully committed to transparency. The cost of all Afghan resettlement schemes, including the Afghan Response Route, has been fully funded as part of the Government’s Spending Review.”
Meanwhile, the NAO is planning a full-scale investigation into the overall cost of settling Afghans in the UK, with a comprehensive report expected in spring 2026. Next week, Members of Parliament on the Public Accounts Committee are set to question MoD officials about the scheme, seeking answers on both the financial and human consequences of the data breach.
The breach has had far-reaching implications, both for those whose lives were put at risk and for the British taxpayer. Up to 27,278 people—those relocated under the ARR or other existing programs—were affected by the leak, making it one of the largest and most consequential security failures in recent memory. A subsequent review in January 2025 questioned whether the scale and cost of opening the new relocation route was truly proportionate to the additional risk posed to those whose data had been breached.
As the government prepares to face parliamentary scrutiny and the NAO’s forthcoming investigation, questions about accountability, transparency, and the true cost of the Afghan data breach remain unresolved. The coming months will be crucial in determining how the UK addresses the fallout from a crisis that has tested both its commitment to allies and its stewardship of public funds.