Thousands of Afghans brought to safety in the UK have had their personal data exposed, after a Ministry of Defence (MoD) sub-contractor suffered a data breach.
The names, passport information and Afghan Relocations and Assistance Policy (Arap) details of up to 3,700 Afghans have potentially been compromised after Inflite The Jet Centre, which provides ground-handling services for flights at London Stansted airport, suffered a cyber-security incident.
It comes just a month after it was a revealed another major data breach in 2022 exposed the details of almost 19,000 people who had asked to come to the UK in order to flee the Taliban.
The government said the incident “has not posed any threat to individuals’ safety, nor compromised any government systems”.
There is currently no evidence to suggest that any data has been released publicly.
The Afghans affected are believed to have travelled to the UK between January and March 2024, under a resettlement scheme for those who worked with British troops.
An email sent out by the Afghan resettlement team on Friday afternoon warned their families that personal information may have been exposed.
“This may include passport details (including name, date of birth, and passport number) and Afghan Relocations and Assistance Policy (Arap) reference numbers,” it said.
Those affected also include British military personnel and former Conservative government ministers, the BBC understands.
A government spokesperson said: “We were recently notified that a third party sub-contractor to a supplier experienced a cyber security incident involving unauthorised access to a small number of its emails that contained basic personal information.
“We take data security extremely seriously and are going above and beyond our legal duties in informing all potentially affected individuals.”
Inflite The Jet Centre said in a statement it believes “the scope of the incident was limited to email accounts only” and has reported it to the Information Commissioner’s Office (ICO).
The ICO confirmed to the BBC it has received a report from Inflite.
Professor Sara de Jong from the Sulha Alliance charity that supports Afghans who worked for the British Army called the breach “astonishing”.
“The last thing that Afghans – who saved British lives – need is more worries about their own and their families’ lives,” she said.
Prof de Jong also urged the MoD to commit to expediting all pending cases of Afghans waiting for relocation.
The incident follows a February 2022 incident in which the personal data of nearly 19,000 Afghans who had applied to move to the UK under the Arap scheme was mistakenly leaked by a British official, leading to thousands of Afghans being secretly relocated to the UK.
The leaked spreadsheet contained the names, contact details and some family information of the people potentially at risk of harm from the Taliban.
That incident was made public for the first time in July.
BBC’s Newsnight programme has meanwhile spoken to the son of a member of the Afghan “Triples” elite special forces who worked with the British Army and was part of the original MoD data breach.
The man and his family initially applied to the Arap scheme – which was set up to relocate and protect Afghans who worked with British forces or the UK government in Afghanistan – shortly after the Taliban returned to power in August 2021.
The family were in Pakistan waiting for a final decision on the application, which was endorsed by the Ministry of Defence last year.
He faced imminent deportation back to Afghanistan, Newsnight reported, after local authorities raided his Islamabad hotel.
His son, who managed to hide from the authorities and speak to the BBC, said his family would not survive if they returned to Afghanistan after their personal details were leaked.
“Please help my family and avoid their murder by the Taliban,” the son said, in a plea to the British government.
On Friday, after the interview, Newsnight learned the man had been deported back to Afghanistan.
In response to news of the deportation, the MoD said in a statement that it was “honouring commitments” to all eligible people who pass their relevant checks for relocation.
“As the public would rightly expect, anyone coming to the UK must pass strict security and entry checks before being able to relocate to the UK.
“In some cases people do not pass these checks,” it said.
Speaking on Newsnight, Sir Mark Lyall Grant, former UK national security adviser, called both breaches “deeply embarrassing” for the British government.
He added that while checks for relocation are necessary, it falls to the British government to “honour the commitment they made”.
“We do need to move faster to protect people who genuinely are at risk of being victimised and persecuted by the Taliban if they go back,” he said.
Speaking to Newsnight, former Conservative Chancellor Kwasi Kwarteng said the data breaches were “very serious” and “really concerning” for people facing deportation back to Afghanistan.
Liberal Democrat Defence Spokesperson Helen Maguire accused the government of “staggering incompetence and clearly inadequate security standards,” as she called for an “immediate, fully independent investigation” into the security breaches.
