UK defence ministry fined for Afghan data breach during IEA takeover

The British data regulator said on Wednesday it had fined the defence ministry for a series of email data breaches that revealed details of over 265 Afghans who were seeking relocation to Britain after the Islamic Emirate of Afghanistan (IEA) took control of Afghanistan, Reuters reported.

The Information Commissioner’s Office (ICO) said it had fined the Ministry of Defence (MoD) 350,000 pounds ($442,000), saying the department did not have operating procedures in place to ensure group emails had been sent securely to Afghan nationals who had worked for or with the British government.

“This deeply regrettable data breach let down those to whom our country owes so much,” Information Commissioner John Edwards said in the statement.

“While the situation on the ground in the summer of 2021 was very challenging and decisions were being made at pace, that is no excuse for not protecting people’s information who were vulnerable to reprisal and at risk of serious harm,” he said.

Ben Wallace, who was defence minister at the time, had already issued an apology in front of the British parliament and launched an investigation into the breach, read the report.

The department had sent an email to a distribution list of Afghan nationals eligible for evacuation on Sept. 20, 2021 with all applicants copied, causing the personal information of 245 people to be inadvertently disclosed, the ICO said.