MoD data breach could see 27,278 Afghans resettled in UK

The Ministry of Defence (MoD) still cannot say exactly how much it has spent on resettling Afghans through the Afghanistan Response Route (ARR), according to a new report from the National Audit Office (NAO).

The scheme was launched in April 2024 in direct response to a February 2022 data breach, which revealed the personal information of thousands linked to the UK mission in Afghanistan. Those affected were at risk of Taliban reprisals yet were not eligible for other resettlement programmes.

The NAO notes that while the MoD has put the total cost of the ARR at around £850 million, “it has not provided sufficient evidence to give confidence regarding the completeness and accuracy of its estimates.” That figure also excludes compensation payments and all legal costs beyond the £2.5 million already expected.

The MoD admits it cannot calculate precisely how much it has spent to date on the ARR. Expenditure was not separately tracked but instead folded into overall Afghan resettlement costs. Officials have argued this was necessary to maintain secrecy while a High Court super-injunction was in force preventing disclosure of both the breach and the scheme itself.

By July 2025, the MoD estimated it had already spent £400 million, with the remainder to be incurred over the coming years. Across all Afghan resettlement routes, departmental spending between 2021–22 and 2024–25 totalled £563 million, with overall costs forecast to exceed £2 billion by 2029. A further £1.5 billion is expected to be spent between now and March 2029.

Who is eligible

The February 2022 breach compromised the details of 18,700 principal applicants to the Afghan Relocations and Assistance Policy (ARAP) and its predecessor scheme. Of these, 1,531 people, along with an estimated 5,824 relatives, were offered places under the ARR specifically because of the data loss.

By the end of July 2025, the MoD assessed that 7,355 individuals would be resettled through the ARR as a direct consequence of the breach. Wider eligibility, however, has pushed the projected number much higher. As the report notes, “The MoD estimates that these applications could result in a total of up to 27,278 people being resettled in the UK (under both the ARR and ARAP schemes).”

According to Home Office immigration statistics published in August, 3,383 had arrived by June 2025. The NAO observed that “many of those invited to the UK under the ARR have not yet arrived,” pointing to delays caused by third-country exit visas, security checks and visa processing.

By the numbers

• 7,355 people – expected to be resettled in the UK through the Afghanistan Response Route (ARR) as a direct result of the 2022 MoD data breach.
• 27,278 people – the total projected number of Afghans to be resettled when combining ARR with the Afghan Relocations and Assistance Policy (ARAP). This includes people whose data was exposed but who were already eligible under existing schemes.
• £850 million – MoD’s current estimate of the historic and future costs of the ARR alone, not including legal fees or compensation.
• £2 billion+ – forecast total cost to the MoD of all Afghan resettlement schemes between 2021 and 2029.

Scheme closure

The ARR was closed to new applicants in July 2025, but reviews of rejected cases continue, including applications from Afghan special forces units known as the “Triples.” If approved, these could add to the already significant totals.

The NAO stresses that its report is not an evaluation of how the MoD managed the scheme, nor an examination of the super-injunction, but a factual briefing to support parliamentary scrutiny. “The report does not seek to evaluate the MoD’s management of or spending on the ARR scheme, nor does it assess the evidence which led to the super-injunction being issued, maintained and then lifted,” it notes.

The Public Accounts Committee (PAC) will now take up the issue. Sir Geoffrey Clifton-Brown MP, Chair of the PAC, said in a statement:

“The NAO briefing published today has provided some much-needed clarity on the Afghanistan Response Route, which was launched following a data breach in 2022. The result was the disclosure of unauthorised personal information on many thousands of individuals, leading to over 7,000 people becoming eligible for resettlement as a direct result of the breach.

After the High Court super-injunction was lifted earlier this year, confusion still remains over the reported £850 million historic and future costs relating to the breach, with the MoD unable to provide sufficient assurance over their numbers. This figure does not include all legal costs or compensation claims, which currently remain unknown.

The PAC will be examining these issues in our inquiry next week and I will be following developments closely as the NAO conducts further work to provide transparency on the figures in their upcoming report on Afghan resettlement schemes, with many of those needing relocation yet to arrive in the UK.”

For the MoD, the task ahead is twofold: resettling thousands whose safety was compromised by its own data loss, and answering questions over its opaque accounting for one of the most costly resettlement undertakings in modern defence history.

Read the report here.