'We let you down' - James Heappey breaks silence on Afghan data breach

A former defence minister has offered a "sincere apology" for the Afghanistan data breach, saying "we let the country down badly". James Heappey was Armed Forces minister when the leak, which may have put up to 100,000 people at risk of death or serious harm from the Taliban, was discovered in 2023.

In a series of posts on X, he said: "I'd like to add my sincere apology to those of other current & former defence ministers for the data breach which compromised details of so many applicants to the ARAP scheme. A great deal happened during my 4 years as MinAF - war in Ukraine, UN mission to Mali, COVID-19, evacuations from Kabul & Khartoum, the Queens's death, the Coronation & much more. MOD was magnificent in response to it all. But on this breach we let the country down badly."

Mr Heappey, a veteran himself, said it was "gut-wrenching" to learn of the accidental leak, saying the person responsible had "screwed up so awfully".

The individual has not been named, although it is understood they are still employed by the Government.

He said: "Few had done more to get people who served alongside our special forces out of Afghanistan. It is incredibly unfair that someone who'd done so much good & changed so many lives deservedly for the better, should also be responsible."

He continued: "But worst part of all, of course, was the mortal danger we feared this breach presented to ARAP applicants whose details had been compromised.

"The intelligence assessment was clear: if the Taleban got their hands on the list, violent & even lethal reprisal was likely."

Judges in June last year said between 80,000 and 100,000 people, including family members of ARAP, were affected by the breach and could be at risk from reprisals from the group.

But an independent review, commissioned by the Government in January this year, concluded that the leaked dataset is "unlikely to significantly shift Taliban understanding of individuals who may be of interest to them".

Mr Heappey added: "Two things can be true. The assessment we received can be accurate then. And the Rimmer Review can be accurate now. Threat changes over time. Suggestion that threat never existed in first place because it is greatly reduced now is nonsense."

The leak occurred in February 2022 but has only now been made public knowledge after an unprecedented superinjunction prevented it from being shared.

It happened when a dataset containing the personal information of nearly 19,000 people who applied for the Afghan Relocations and Assistance Policy (ARAP) scheme was inadvertently emailed outside of a secure government system.

ARAP, launched months before the fall of Kabul to the Taliban in 2021, was responsible for relocating Afghan nationals who had worked for or with the UK Government, such as interpreters, and were therefore at risk of reprisals from the group.

The Ministry of Defence (MoD) only became aware of the breach more than a year after the release, when excerpts of the dataset were anonymously posted onto a Facebook group in August 2023.

Mr Heappey said he believes the injunction was needed but whether it needed to be extended is "moot".

He also shared that there was a "palpable and justified" anger within Government towards the MoD following the breach.

"There were some pretty choice words offered in meetings," he revealed.

The breach led to the creation of a secret rescue mission which is expected to cost £850 million - pushing the total amount of all UK Afghan relocations to up to £6 billion, although previous Government estimates were set at £7 billion.

It is thought around 24,000 people, including family members, affected by the breach have arrived or will come to the UK.