Afghan data breach: Life-threatening error shows why we must all take cyber security seriously

In February 2022, the official, who was attempting to check details in the files, emailed a dataset that they thought contained just 150 rows of information to someone outside the secure government system. In fact, there were more than 33,000 rows.

The Ministry of Defence only became aware of the breach in August 2023, when excerpts were posted anonymously on Facebook. Scrambling to prevent loss of life, the then Conservative government set up a secret £850 million scheme to bring thousands of Afghans to the UK and took out a super-injunction to prevent media reports in the hope that the Taliban would not notice.

Yesterday, after the injunction was lifted, Defence Secretary John Healey offered a "sincere apology on behalf of the British Government" for the data breach. About 6,900 people are expected to be relocated to the UK by the end of the scheme.

There are many aspects to this story – the brutality of the Taliban first and foremost, the use of a super-injunction to suppress free speech and the absence of democratic scrutiny of a secret government scheme. But it feels like ministers did their best to respond to a difficult and dangerous situation.

However, one lesson that we should all take from this is how computers can amplify simple human errors countless times over. In days gone by, a letter containing a few pages of sensitive information may have been sent out in error, but not 33,000.

According to the National Cyber Security Centre, “whether you’re working for critical infrastructure making sure the lights stay on, or simply setting up your child’s phone, the UK’s cyber security is now a shared responsibility where everyone needs to play a part”.

Not all of us work for the MoD, but most employers have websites vulnerable to cyber attacks. We need to ensure our mindset about security is one fit for the digital present, not our analogue past.