MOD faces first legal claim over data breach that leaked details of thousands of at-risk Afghans
A law firm specialising in data protection has taken the "first formal step" in legal action against the Ministry of Defence, after a 2022 spreadsheet leak containing details of thousands aiming to flee Afghanistan for life in the UK.
Manchester-based Barings Law confirmed a Letter of Claim has been sent to the department, regarding the accidental breach impacting Afghan nationals after the Taliban's return to power.
Previous reports have suggested the leak involved the personal data of almost 19,000 people, applicants for resettlement, potentially putting them and their families at risk of reprisal attacks.
Information provided by Barings Law describes a case relating to personal details of approximately 25,000 Afghan applicants and their family members who had applied for relocation.
Efforts to resettle people in direct response to the breach were estimated by the MOD to cost around £850m, although a report released by the Public Accounts Committee (PAC) in November noted that figure hadn't included legal costs or the potential cost of future compensation claims.
Robert Whitehead, chairman of Barings Law, said: "This legal action represents the first formal step towards holding the Ministry of Defence accountable for what we believe was a catastrophic failure to safeguard highly sensitive personal data."
"We have evidence that people named on the leaked database, or those closely connected to them, have since been killed or subjected to intimidation and extortion by the Taliban, including threats made against their loved ones.
"Our clients include individuals who have managed to reach safety in the UK, as well as others who remain in Afghanistan and are still in hiding, living in constant fear.
"It was the Ministry of Defence's responsibility to protect this information, and the consequences of that failure are profound. This case is expected to test new legal ground around the rights of data breach victims where the harm extends beyond financial loss to issues of personal safety and loss of life.
"Our clients will beseeking anonymity in any proceedings for their own protection, and we will be seeking on their behalf appropriate compensation that reflects the severity of what they have endured."
The breach occurred in February 2022, when a British soldier inadvertently sent the database in unsecure emails. The error was not publicly disclosed at the time.
The database also included details of some MI6 operatives and UK Special Forces personnel.
In August 2023, the High Court imposed a super-injunction preventing the media and involved parties from reporting the breach or acknowledging the existence of the injunction. The order was lifted in July 2025, allowing the case to be reported publicly for the first time.
Last month, the PAC revealed it wasn't confident the MOD had done enough to stop similar incidents to the 2022 breach from happening again and that the department had been "inappropriately" using Excel spreadsheets on a SharePoint site amid the deteriorating situation in Afghanistan.
The committee asked for a six-monthly update on resettlement activity and accurate costings relating directly to the breach.
BFBS Forces News have contacted the MOD for a response to the Letter of Claim brought forward by Barings Law.
Related topics
Join Our Newsletter
