Afghans who assisted British troops have been subjected to a data breach involving their personal information, marking the 50th such incident in the past five years. The breach occurred within the International Organization for Migration (IOM), an entity crucial to processing applications for sanctuary in the UK under the Afghan Relocations and Assistance Policy (ARAP).
The IOM handles the personal details of eligible Afghans and their families, including contact information, and facilitates biometric and TB checks, primarily in Pakistan and now Tajikistan, as part of their relocation to the UK. This latest incident comes at a time of heightened risk for those who worked with Western forces, as the Taliban marks five years in power.
An IOM spokesperson acknowledged the leak, stating that the organization "took immediate corrective action, strengthening internal controls." The spokesperson added that the incident has been resolved and does not impact current operations. A government spokesperson described the event as a "limited incident" with a "low" risk to individuals, emphasizing proactive measures taken with the IOM to inform affected individuals.
This breach follows intense scrutiny of the government's handling of data security. Just three months prior, a government superinjunction that had suppressed news of a significant Ministry of Defence data leak for nearly two years was lifted. A scathing Parliamentary Inquiry by the Commons Defence Committee had previously condemned the use of such injunctions, stating that a prior breach had put 100,000 Afghans at "risk of death."
The Daily Mail reported that the latest breach was discovered in August 2023 and was kept secret by the superinjunction until its recent lifting after a legal battle. In the four years preceding this incident, data belonging to Afghans had been compromised 49 times due to errors by defense officials, with the exact nature and scale of each breach often undisclosed. Some of these were attributed to human error, while others resulted from cyberattacks. Last August, personal data of former ministers, British troops, and thousands of Afghans was compromised when a subcontractor handling airport services was breached.
Recipients of the leaked data expressed dismay and anger. One individual, a former frontline interpreter in hiding in Afghanistan, described the situation as "a betrayal of our trust." Another called it "shameful," while a former Afghan Special Forces soldier warned that such "mistakes risk lives."