The MoD was forced to set up a secret evacuation scheme after an official accidentally leaked details of Afghans who might be vulnerable to the Taliban
More than 7,000 Afghans are expected to be resettled in the UK because of a massive Government data leak, with the full costs of the blunder unknown even to officials, the spending watchdog has found.
The National Audit Office (NAO), which scrutinises public spending for Parliament, said an estimated 7,355 people will be resettled through a secret scheme designed to bring victims of the massive data breach to the UK.
The Ministry of Defence (MoD) estimated that the emergency scheme, which was kept under wraps until July 2025 through a gag order on journalists, will cost the taxpayer £850m in resettlement costs and at least £2.5m in legal fees.
But the NAO found that the MoD did not know exactly how much it spent on the scheme because it did not separately identify these costs in its accounting system.
It also warned that the potential cost of future compensation claims against the MoD as a result of the data breach was “unknown.”
The Afghan Response Route (ARR) was set up in April 2024 to bring over Afghans whose safety had been jeopardised by a data breach two years earlier.
During the breach, the personal details of 18,700 people who may be at risk from the Taliban and had applied to the Afghanistan Relocations and Assistance Policy (ARAP) scheme were accidentally shared by an MoD official.
The ARR scheme arranged or funded relocation to the UK, offered accommodation for up to nine months, support to find a long-term home and learn English, as well as access to healthcare, education and other public services, for them and their families.
Of the 18,700 people whose data was leaked, 4,716 have so far been offered resettlement in the UK.
Of these, 3,185 individuals were already eligible for other reasons through the ARAP scheme, but 1,531 were offered resettlement directly as a result of the breach.
At the end of July 2025, the MoD internally estimated that, including both the 1,531 principals and their family members, the ARR would result in 7,355 people being resettled in the UK directly as a result of the data breach, the NAO said.
This means each resettled individual bringing an average of nearly five family members.
However, this could change as applications are received and processed, the NAO said.
What was the data breach and why was the scheme set up?
The data breach occurred in February 2022 when a MoD official emailed a spreadsheet that contained a hidden tab containing the details of 18,700 applicants to the ARAP scheme to a “trusted source” outside of the MoD.
ARAP was a scheme which resettled Afghans who had worked with the British forces during their military presence in the country between 2001 and 2021, often at great personal risk, in the UK.
It was set up shortly before the Taliban seized control of Afghanistan in August 2021, when 2.5 million people fled the country, and it scaled up at that point.
The spreadsheet contained names, contact details, and in some cases, family information of applicants.
The breach was not discovered until August 2023, when personal details of ten individuals from the dataset were posted online on Facebook.
The ARR scheme was set up specifically for people whose details were in the spreadsheet and subsequently were at high risk of reprisals by the Taliban as a result of the breach.
It was kept secret by a superinjunction granted by the High Court, designed to protect the safety of those being resettled.
Total cost unknown ‘due to accounting system’
The MoD said it would not separately identify the costs of the resettlement scheme in its accounting system in order to comply with the superinjunction.
The Defence Secretary stated in Parliament in June that the total cost of all Afghan relocation schemes to date is around £2.7 billion, but did not specify the costs of ARR within that.
Tobias Ellwood, a former defence minister, said that “the financial cost of a single colossal mistake continues to shock”, though said it was “difficult to see what little choice the MoD had but to respond by procuring an emergency resettlement programme.”
He added: “A series of Commons committees are now investigating the data breach. But the MOD should not wait until then to answer pressing questions about how obvious protocols were not in place that would have prevented the scale of this mistake – if not the human error in the first place.”
A defence insider said that the MoD cost estimations given to the NAO are based on current estimates of the cost per person to relocate, provide nine months transitional accommodation, and council funding to support settled accommodation, and that these costs are spread across different Government departments.
An independent review of the ARR scheme, known as the Rimmer review, completed in June 2025, found that it was unlikely that merely being included in the dataset would be grounds for being targeted by the Taliban, and that it was plausible that the contents of the dataset had not spread as widely or rapidly as was initially feared.
SSubsequently, the MoD closed the scheme and scrapped the superinjunction which had kept it hidden.
An MOD spokesperson said: “We are committed to honouring the moral obligation we owe to those Afghans who stood with us and risked their lives.
“Since taking the decision to support the lifting of the super injunction brought by the previous government, we have been clear on the costs associated with relocating eligible Afghans to the UK – and are fully committed to transparency.
“The cost of all Afghan resettlement schemes, including the Afghan Response Route, has been fully funded as part of the Government’s Spending Review.”
