Afghan relocation data breach
In February 2022, a UK Ministry of Defence official emailed an Afghan relocation casework file outside authorized government systems. The spreadsheet contained personal information associated with 18,714 people who had applied to the relevant schemes by 7 January 2022, including names, contact details, and in some cases information about relatives or supporters.
The government learned in August 2023 that details from the file had appeared online. A superinjunction restricted disclosure until July 2025, while a special relocation route was created for people judged at highest risk of Taliban reprisals.
This is a defining High-consequence data incident. The harm arose not only from disclosure but from the mismatch between a casework spreadsheet and the life-or-death threat model of the people represented in it. It grounds the need in Case for privacy and security for strict access boundaries and data separation.