More than 7,300 Afghans are expected to be resettled in the UK as a result of a major government data breach, according to a National Audit Office report that raises doubts over officials’ claims of a £850m cost.
The accidental leak by an MoD official in 2022 of 18,700 Afghans’ details who had worked with or for the British government led to the opening of a new route by which those endangered could seek relocation to the UK from their home country.
The MoD expects 7,355 people to be resettled through the Afghanistan response route (ARR) as a direct result of the breach, including the family members of those directly affected, the NAO said.
The watchdog said the government was unable to calculate the exact cost of its response. The £850m estimate did not include legal costs or compensation claims, and doubts were raised by the NAO about the “completeness and accuracy” of the base figure.
The NAO said: “The MoD estimates that, as of July 2025, the government had spent around £400m on resettling people through the ARR and that it would spend around a further £450m on the scheme.
“The MoD estimated the costs to the whole of government to be £128,000 per resettled individual, of which an estimated £53,000 would be met by the MoD. At the time of publication, the MoD had not provided us with sufficient evidence to give us confidence regarding the completeness and accuracy of these estimates.”
The spreadsheet accidentally shared by the MoD comprised 33,345 lines of data containing the names and contact details of applicants and, in some instances, information relating to the applicants’ family members.
The NAO said the MoD did not record exactly how much it had spent on resettling people through the ARR scheme because it did not separately identify these costs in its accounting system.
The government said it did this to maintain the secrecy of the ARR scheme while a superinjunction was in place preventing disclosure of both the data breach and the existence of the injunction itself.
After the discovery of the data breach on 25 August 2023, the MoD had applied to the high court for an injunction to prevent the data loss becoming public. Seven days later, the court granted a superinjunction – which also prevented disclosure of the existence of the injunction itself, when a judge accepted the MoD’s assessment of risk to the safety and lives of many individuals and their families.
A subsequent review in January 2025 suggested that the cost and scale of opening the new route for relocation was not proportionate to the additional risk to those whose data had been breached. The defence secretary, John Healey, closed the ARR and the injunction on reporting was dropped in July.
Sir Geoffrey Clifton-Brown, the chair of the cross-party public accounts committee, said: “After the high court superinjunction was lifted earlier this year, confusion still remains over the reported £850m historic and future costs relating to the breach, with the MoD unable to provide sufficient assurance over their numbers.
“This figure does not include all legal costs or compensation claims, which currently remain unknown. The PAC will be examining these issues in our inquiry next week and I will be following developments closely as the NAO conducts further work to provide transparency on the figures in their upcoming report on Afghan resettlement schemes, with many of those needing relocation yet to arrive in the UK.”
