UK Government Faces Scrutiny Over Afghan Data Breach and Legacy IT Issues

UK government officials are under scrutiny for legacy IT issues that have hampered efforts to secure sensitive data. During a recent hearing, the Science, Innovation and Technology Committee questioned ministers about the government’s response to a significant data breach involving the Ministry of Defence (MoD), which exposed details of approximately 19,000 Afghan informants. This incident, considered one of the most sensitive leaks in British history, occurred due to a CC-not-BCC email blunder.

The Information Security Review, conducted in 2023 but published in August 2025, recommended 14 measures to enhance data security, including developing methods for cross-government information sharing that do not rely on email. Ian Murray, the minister for digital government and data, highlighted the importance of cultural change in preventing human error, which has been a significant factor in data leaks.

Aimee Smith, the chief data officer, pointed out the challenges posed by various legacy systems across departments, which often necessitate the use of email attachments for information transfer. Despite these challenges, Smith stated that adequate capabilities exist within government departments to share documents securely.

The committee also pressed for transparency regarding the government’s compliance with data security standards, revealing a 90 percent compliance rate from an assurance exercise conducted in October 2025. However, details regarding the specific legacy systems and their security ratings remain confidential to protect against potential attacks.

The hearing underscored the need for the government to maintain high data security standards, especially with the upcoming digital ID program and ongoing eVisa system issues. The committee chair emphasized the importance of measurable metrics to track progress in implementing the review’s recommendations.

• Legacy IT systems are hindering the UK government’s ability to secure sensitive data effectively.
• The Ministry of Defence’s data breach exposed details of around 19,000 Afghan informants.
• The Information Security Review recommended 14 measures to improve data security practices.
• Government officials acknowledged the challenges posed by different legacy systems in sharing information securely.
• Transparency regarding compliance with data security standards is crucial for public trust.