LONDON: More than 3,000 Afghans, British troops and government officials have had their personal data breached following a cyberattack, the UKâs Ministry of Defense has said.
Some of the victims may have had their information hacked for a second time, following the ministryâs high-profile Afghan data breach discovered in 2023, which was the subject of a superinjunction â preventing it from being publicly disclosed â until last month.
The 2023 breach exposed the identities of thousands of Afghans who had served alongside British forces as part of the multinational decade-long conflict against the Taliban. Many of them reported receiving threats after the leaked database was apparently discovered by Afghanistanâs Taliban rulers.
Following the latest incident, an alert was sent to about 3,700 affected people on Friday, The Times reported. They were told that their personal information had been breached, including name, date of birth and passport number.
The data was included in a record of information relating to evacuation flights from Afghanistan to Englandâs Stansted Airport between January and March 2024.
Inflite, a third-party subcontractor hired by the ministry, held the data. The firm suffered a ransomware attack thought to have been carried out by criminal gangs.
More than 100 British personnel were victims of the breach. The rest of those affected are Afghans.
The ministry said in its alert: âThere is a risk that some of your or your familyâs personal information may be affected. This may include passport details (including name, data of birth, and passport number) and Afghan Relocations and Assistance Policy reference numbers.â
Those alerted were requested to âplease remain vigilant and be alert to unexpected communication or unusual activity.â
So far, there is no evidence that any of the information has been released publicly or on the dark web, ministry sources told The Times.
The latest leak adds to growing embarrassment over the UKâs handling of the Afghanistan withdrawal, which was completed in 2021.
Sir Mark Lyall Grant, former UK national security adviser, told the BBCâs âNewsnightâ program that both breaches were âdeeply embarrassingâ for the government.
Verification as part of the relocation process is necessary, but the British government must âhonor the commitment they made,â Grant added.
âWe do need to move faster to protect people who genuinely are at risk of being victimized and persecuted by the Taliban if they go back,â he said.
It was revealed that the governmentâs multi-year superinjunction on the previous Afghan data breach cost taxpayers more than $3 million.
An emergency government scheme that was hidden from the public in response to the breach may have cost more than $9 billion, as part of efforts to bring at-risk Afghans to Britain.
Adnan Malik of Barings Law, which is representing 1,400 Afghans affected by the previous data leak, said: âThis is public money they used to cover their own backs. Barings Law will continue to pursue justice for all of those affected, and stop the deceit on behalf of the Ministry of Defense.â
A former interpreter who suffered war injuries in Afghanistan and now campaigns for his Afghan ex-colleagues told The Times that he was âtruly worriedâ about how the ministry has mishandled the personal data of Afghan allies.
âOnce again, they have failed to protect those who stood shoulder to shoulder with them in the fight against terrorism,â said Rafi Hottak. âHow can it be that weâve now had three separate data leaks involving one of the most vulnerable group of people?â
A spokesperson for Inflite said: âWhile we cannot comment on specific details of the data security incident or any communications related to it due to the sensitivity of the matter, we remain fully committed to protecting our systems, data, and the interests of all our stakeholders.â
A government spokesperson said: âWe were recently notified that a third-party subcontractor to a supplier experienced a cybersecurity incident involving unauthorized access to a small number of its emails that contained basic personal information.
âWe take data security extremely seriously and are going above and beyond our legal duties in informing all potentially affected individuals.
âThe incident has not posed any threat to individualsâ safety, nor compromised any government systems.â
-ENDS-