Members of Parliament have launched a formal investigation into the Conservative government's handling of a catastrophic security breach that exposed the personal details of nearly 19,000 Afghans who sought UK refuge from the Taliban.
Whistleblower Reveals Taliban Capabilities
A whistleblower, identified only as Person A, has told the Afghan leak inquiry that the Taliban are using sensitive technology abandoned by British forces to track down targets. The independent volunteer caseworker testified that Afghans affected by the data breach were advised to relocate and change their phone numbers immediately for protection.
"There seems to be this misconception that the Taliban do not have the same sort of facilities that we have," she told the defence select committee during a private hearing on 18 November. "We left it all behind in Afghanistan; they have it. If they have your phone number, they can trace you down to within metres."
The Data Breach Timeline
The security catastrophe began in February 2022 when an official at UK special forces headquarters accidentally leaked a spreadsheet containing highly sensitive information. The document included names, contact details, and in some cases family information of nearly 19,000 Afghan applicants seeking relocation to Britain.
The breach remained undetected until August 2023, when the names of nine applicants appeared on Facebook. Person A discovered this development and immediately alerted the Ministry of Defence. Preliminary research submitted to the inquiry suggests at least 49 family members and colleagues of affected Afghans have been killed since the leak occurred.
Government Response and Legal Restrictions
The government obtained a superinjunction in August 2023 that prevented any information about the leak from being made public until July 2025. Person A revealed she was served with this injunction during a Teams call with government officials on 18 September 2023, without being offered legal advice.
She had initially alerted both Conservative armed forces minister James Heappey and his Labour counterpart Luke Pollard about the leak by email on 13 August 2023. She received no response from Heappey until 28 August, after she tagged him in a social media post.
Restricted by the injunction, Person A and her organisation could only warn Afghan families that "somebody's phone had been compromised" and recommend they move locations and change phone numbers if possible.
The whistleblower strongly contested findings from Paul Rimmer's government review, which suggested the data leak was unlikely to substantially increase individual risk. "They do not just target the principal applicant; they target the families," she stated, describing horrific accounts of torture including electrocution, waterboarding, and four-year-old children having their arms broken.
