At least 49 relatives and colleagues of Afghans whose personal data was leaked by the UK Ministry of Defense (MoD) have been killed, according to new research submitted to Parliament.

The findings, presented to the Commons Defense Select Committee, are the first on-the-ground study into the human impact of the MoD’s 2022 data breach, which exposed the details of nearly 19,000 Afghans who had applied to move to the UK after the Taliban’s return to power, British media has reported.

The study examined the experiences of 350 people affected in Afghanistan, the UK, and elsewhere. Of the 231 individuals who were formally notified by the MoD that their information had been compromised, 49 said that either a family member or a colleague had been killed as a result. Another 200 reported threats made against themselves or their families, and 99 said their lives had been directly threatened because of the breach. More than half said family members or friends in Afghanistan had been threatened by the Taliban.

Afghans who served UK faced 'violent assaults'

Olivia Clark, executive director of Refugee Legal Support, which carried out the research alongside academics from Lancaster and York Universities, said the research "lays bare the devastating human consequences of the MoD data breach". She added that "by centring Afghan voices and documenting their experiences, it fills a critical gap in understanding the real-world impact of the breach."

"Afghans who served alongside UK forces have faced renewed threats, violent assaults, and even the killing of family members after their personal details were exposed. The UK government must act urgently to ensure their safety, accelerate relocation applications, and provide proper redress for those whose lives have been put at risk," The Guardian newspaper reported on Monday (October 27).

How did the 2022 data breach unfold?

The data breach occurred in February 2022, when a British defense official mistakenly released a spreadsheet containing names and contact details of Afghan Relocations and Assistance Policy (ARAP) applicants. The MoD only discovered the leak in August 2023 after details appeared on the social media platform Facebook. A super injunction then blocked media coverage until it was lifted in July 2025.

A former member of the Afghan National Army who took part in the study said: "The delay between the discovery of the data breach in 2023 and the communication in July 2025 is deeply concerning and unacceptable. Waiting almost two years to inform individuals that their personal data was compromised has put many lives at risk unnecessarily. Immediate notification could have allowed us to take protective measures much earlier."

Taliban denies targeting Afghans affected by breach

In July, the Taliban government denied targeting or monitoring people affected by the breach, with a spokesperson saying "nobody has been arrested for their past actions, nobody has been killed and nobody is being monitored for that."

Human rights groups and the UN, however, have documented hundreds of cases of killings and abuses against former officials and security personnel since the Taliban takeover. Since April 2024, around 4,500 Afghans have been relocated to the UK under the Afghanistan Response Route, a program created to assist those at risk after the breach.

An MoD spokesperson said that "the independent Rimmer review … concluded that it is highly unlikely that merely being on the spreadsheet would be grounds for an individual to be targeted." Campaigners however are calling on the UK to bring those affected not only to safety but that the UK authorities offer more accountability to the people they pledged to protect.

With AFP and dpa