Thousands of Afghan nationals have quietly been relocated to the United Kingdom through a classified programme initiated after a serious data breach exposed their identities, putting many at risk from the Taliban.

The breach, which occurred in February 2022, involved the personal details of nearly 19,000 Afghans who had applied to resettle in the UK following the Taliban’s return to power.

It only came to the attention of the previous administration in August 2023 when some of the leaked data surfaced on Facebook.

In response, a secret relocation initiative, later named the Afghan Relocation Route, was established nine months after the breach.

So far, 4,500 Afghans from the affected list have been brought to the UK under the scheme. Until now, both the data breach and the relocation process were hidden from the public under a court-imposed super-injunction.

The existence of the leak and the UK government’s response were finally made public on Tuesday, following a ruling by High Court judge Justice Chamberlain, who lifted the strict gag order.

In his judgement, Chamberlain said the super-injunction had “completely shut down the ordinary mechanisms of accountability which operate in a democracy”, creating what he described as a “scrutiny vacuum”.

The breach exposed names, contact details, and family information of individuals considered to be at high risk of Taliban retaliation. Defence Secretary John Healey addressed Parliament on Tuesday, offering a “sincere apology” to those affected. He confirmed the breach occurred after a spreadsheet was mistakenly emailed outside authorised systems, calling it a “serious departmental error”. However, the Metropolitan Police concluded that a criminal investigation was not necessary.

Healey revealed that the leaked list included senior Afghan military officers, government officials, and MPs. “It was one of many data losses during that chaotic period,” he said, referring to the 2021 evacuation operation.

Conservative leader Kemi Badenoch also issued an apology, saying: “Somebody made a terrible mistake and names were put out there… and we are sorry for that. That should not happen.”

Despite the UK Ministry of Defence (MoD) acknowledging that 600 Afghan soldiers and 1,800 of their family members from the leak are still in Afghanistan, the secret relocation scheme is now being wound down. However, the government stated that all outstanding relocation offers already made will still be honoured.

The MoD has spent £400 million on the scheme so far and anticipates spending a further £400–450 million.

The department also admitted that the individuals whose data was leaked were only formally notified on Tuesday and have been advised to take precautions, such as securing their digital footprint and avoiding suspicious communications.

Justice Chamberlain noted in his ruling that it was “quite possible” members of the Taliban or individuals linked to them viewed the leaked data posted on Facebook.

While there were initial fears that up to 100,000 people could be endangered due to the leak, an MoD-commissioned review later concluded that widespread targeting was “highly unlikely” and that the risk “may not have spread nearly as widely as initially feared”.

The MoD declined to say whether any affected individuals had been arrested or killed as a result of the breach. However, the same review labelled the secret relocation plan as an “extremely significant intervention”.

Healey confirmed the individuals resettled under the secret scheme had already been included in official immigration statistics.

The origin of the crisis dates back to the rushed withdrawal of US troops from Afghanistan in August 2021, during which the Taliban swiftly reclaimed control of Kabul.

The UK had launched the Afghan Relocations and Assistance Policy (Arap) to process and evacuate vulnerable individuals, with over 36,000 Afghans eventually brought to the UK.

Public scrutiny over the handling of the evacuation had already been intense. A 2022 inquiry by the Foreign Affairs Committee described the process as a “disaster” and a “betrayal”.

The press had become aware of the secret resettlement programme shortly after its creation, prompting the government to seek an emergency court order. Then-Defence Secretary Ben Wallace personally applied for the super-injunction to allow the government time to assist those at risk before news of the breach could escalate danger.

The court initially agreed, even preventing reporting on the existence of the injunction itself.

It was extended in November 2023 amid fears the Taliban were unaware of the leaked data. But Justice Chamberlain ultimately ruled that the Taliban “likely already possess the key information” and that disclosing the existence of the scheme posed no further serious risk.

Shadow Defence Secretary James Cartlidge, who served in government when the scheme was launched, criticised the situation: “This data leak should never have happened and was an unacceptable breach of all relevant data protocols.”

Erin Alcock, a lawyer at Leigh Day — the legal firm supporting hundreds of affected Arap applicants — described the breach as a “catastrophic failure”.

Earlier this month, the government confirmed separate payouts had been offered to Afghans affected by a different data breach.