British spies unmasked in Afghan data leak

Among the worst-case scenarios for British intelligence

The personal details of more than 100 British officials, including operatives for the SAS and MI6, were revealed in the Afghan data breach two years ago, we now know.

The incident, which has not been able to be reported on until this week, saw the names, contact details and family information of nearly 19,000 Afghans who had worked with the British during the 20-year war in their country leaked by accident.

It has now been revealed that over 100 British individuals were also named in the leak, including members of the special forces and MI6, the UK’s covert foreign intelligence service.

Detailed case notes in the leaked database contained secret personal information of these individuals, potentially putting them at risk.

For foreign agents, having your name and details exposed is among the worst-case scenarios.

Though the physical risk has been deemed minimal, the leak has been called potentially the worst incident to affect the intelligence services since former officer Richard Tomlinson published a list of names online in 1999.

It would be especially damaging if the list had made its way into the hands of a hostile state, such as Russia, Iran or North Korea.

What’s the background?

The leak happened in February 2022, during the withdrawal of Western forces from Afghanistan. At the time someone working at the UK Special Forces headquarters in London accidentally emailed more than 30,000 resettlement applications to someone outside of government.

However, the government did not become aware of the leak for more than a year. It first came to light in August 2023, when someone posted details from the list on Facebook.

In September that year the Ministry of Defence applied for an injunction to stop the leak from becoming public knowledge, fearing it would put Afghan lives at risk. The MoD was actually granted a super-injunction, which not only prevents details of the leak being reported but any mention of the leak itself, as well.

The injunction was only lifted this week, more than three years after the breach took place.