MoD linked supplier breach exposes Afghan data

A cyber-attack at Inflite The Jet Centre linked to the defence ministry exposed personal data of Afghans in a resettlement program.

MoD linked supplier breach exposes Afghan data

Inflite The Jet Centre Ltd, a private company that provides ground services for flights linked to the Defence Ministry and the Cabinet Office, said a data breach affected up to 3,700 people. The exposed data relates to individuals connected to the Afghan Relocations and Assistance Policy and those who travelled through London Stansted between January and March 2024. The incident appears limited to access to a subset of company emails, and the firm has notified the Information Commissioner’s Office and is working with the National Crime Agency and the National Cyber Security Centre.

The government says there is no threat to individuals’ safety and no breach of government systems. The incident is not believed to have involved data released on the dark web. The case echoes a 2022 breach that affected 18,714 Afghans who had worked with British forces, and a later apology from the defence secretary followed.

Private contractors hold sensitive data, and this case shows how third party risk can touch humanitarian programs. It calls for clearer rules on data sharing and stronger oversight of suppliers used by defence ministries. Public confidence depends on timely transparency and accountability when data leaks happen. The episode also highlights the ongoing tension between rapid support for refugees and the need for tighter data protections across outsourced services.

Highlights

The lesson is to tighten controls while keeping humanitarian work moving.