A UK parliamentary inquiry has found the catastrophic 2022 Afghan data breach was a foreseeable systemic failure caused by inappropriate tools, weak procedures and a poor data protection culture, not a single employee's mistake.
The finding comes from the House of Commons Defence Committee report "Shifting heaven and earth? The Afghan data breach and resettlement schemes", published on 30 July 2026. https://committees.parliament.uk/committee/24/defence-committee/
The breach exposed personal details of more than 18,500 people who applied to the Afghan Relocations and Assistance Policy scheme. In February 2022 a member of Ministry of Defence personnel emailed a spreadsheet to a trusted third party, believing it held about 150 records. Once the file left government systems, the department could no longer control who accessed it.
The committee branded the MoD's reliance on Microsoft Excel a "continuing cultural failure". It found the department relied for too long on inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity and an inadequate culture of data protection and accountability.
The report said those who designed the case management system did not sufficiently understand the data-handling risks they were creating. Recommendations made after earlier data incidents in 2021 were not implemented in time, and corporate knowledge was lost through high staff turnover.
The committee called for clear senior ownership of risk and minimum standards across government for life-endangering datasets. It noted the MoD is now implementing a Digital Records Management Plan and strengthening caseworker training.
The episode has sharpened focus on automated data classification and leak prevention. As IDM reported, in May 2025 Australia's Castlepoint Systems was awarded an enterprise licence for its AI-driven automated data classification solution by the Ministry of Defence, its first UK account. https://idm.net.au/article/0015300-uk-defence-ministrys-compliance-crisis-deepens
Castlepoint's Explainable AI technology provides real-time, automated control over complex datasets to reduce the risk of human-led errors when handling sensitive data. The company says its autoclassification can increase labelling accuracy and coverage without disrupting personnel.