Court documents made public on July 15 have revealed that the UK government established a covert relocation operation in response to a data breach that exposed personal details of more than 33,000 Afghans who assisted British forces.

The High Court’s May 2024 ruling indicated that approximately 20,000 individuals could require relocation under the scheme, with projected costs reaching several billion pounds.

The data leak occurred in early 2022 when a Ministry of Defence official mistakenly forwarded emails containing sensitive information on roughly 19,000 applicants to the Afghan Relocations and Assistance Policy (Arap), as well as about 6,000 of their family members.

The breach was only detected in August 2023 when portions of the data appeared on Facebook, prompting immediate action.

In parliamentary testimony, Defence Secretary John Healey confirmed that by May 2025 around 16,000 individuals affected by the breach had been resettled in the UK, with approximately 4,500 more either in transit or already relocated at an estimated cost of £400 million.

The covert programme had been authorised under a super-injunction granted in 2023 to prevent the disclosure of the breach, citing threats of Taliban reprisals.

A Ministry of Defence–commissioned review, released alongside the court decision, also stated that, as of the deadline, 16,000 had been relocated with limited evidence of organised Taliban retaliation, though Afghanistan remains classified as a dangerous environment.

An ancillary review outlined earlier projections that the covert relocation programme could cost as much as £7 billion, though subsequent assessments revised the figure down to around £850 million for delivering protection to those specifically affected by the leak.

Overall Afghan resettlement costs, under multiple programmes since 2021, totalled between £5.5 billion and £6 billion.

The super-injunction, one of the first of its kind, was imposed in September 2023 to prevent publication of both the leak and relocation plan.

It was lifted in July 2025 following legal challenges.

Despite the undisclosed nature of the operation, the Ministry has defended its position, citing imminent risks of extrajudicial violence against those named.

Around 665 individuals affected by the breach have announced plans to sue the Ministry of Defence, seeking compensation potentially in the tens of thousands per person.

The Ministry of Defence is also facing additional claims linked to earlier 2021 email-data leaks, which earlier incurred a £350,000 fine by the Information Commissioner’s Office.

Following the High Court proceedings, the current defence secretary announced the closure of the Afghanistan Response Route (ARR), one element of the operation established to assist those at risk from the data exposure.

He also acknowledged the need for greater parliamentary and public oversight of such schemes.