Loading story…
A data breach at the UK Ministry of Defence in February 2022 exposed the personal details of approximately 19,000 Afghan citizens who had assisted British forces, as well as some senior British officials and spies. The leak, which was not discovered until part of the list was published online in August 2023, resulted in the Taliban targeting those named, leading to direct threats, home raids, and, in many cases, the deaths of family members and colleagues. Research by Refugee Legal Support, supported by UK academics, found that 49 individuals reported losing family or colleagues due to the breach, and nearly 100 reported direct threats to their own lives. The majority of those affected have not been offered relocation to the UK, leaving them and their families at continued risk.
The Information Commissioner's Office fined the Ministry of Defence £350,000 for a previous, smaller breach in 2021, but the 2022 incident is considered one of the UK's most damaging data protection failures. The Taliban have used the leaked information to systematically hunt down those who aided Western forces, with 87 percent of surveyed victims reporting personal risks and over 100 reporting home raids. The UK government responded by securing a super-injunction to limit reporting on the breach, but the ongoing intimidation, violence, and lack of adequate support for those affected highlight the severe human cost of the incident.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
The UK Ministry of Defence experienced a data breach involving information related to Afghans, exposing affected people to serious risk. Reporting on the incident emphasizes human consequences including fear, beatings, and killings tied to the leak.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK Ministry of Defence disclosed that a malign actor accessed part of an armed forces payment network operated by an external contractor, exposing personal data for serving personnel, reservists, and some recently retired veterans. The compromised records included names and bank details and, in a smaller number of cases, home addresses; reporting also cited National Insurance numbers among the exposed information. The affected platform was described as separate from the MoD’s core network and main military HR systems, and the government said no operational defence data was obtained. The MoD took the contractor-run system offline, halted payment processing on that platform, opened a full investigation, and began notifying affected individuals while offering helplines, monitoring, welfare, and financial support. Ministers said they could not rule out state involvement and were examining potential failings by the contractor that may have enabled the intrusion, while broader commentary on the incident highlighted the supply-chain risk posed by third-party service providers, the possibility that attackers remained undetected for weeks, and the heightened personal safety risks that exposed military identities and locations can create, including fraud, harassment, blackmail, and targeting.
Jun 29, 2026
Personal data for more than **100,000 UK police officers and staff** was reportedly leaked on the dark web after a major breach affecting multiple government bodies. Exposed information included **full names and contact details**, with reporting indicating the incident also impacted the **Ministry of Defence**, **Home Office**, **National Crime Agency**, and **Crown Prosecution Service**, adding to concerns over the exposure of sensitive law-enforcement and government personnel records. The intrusion has been attributed in reporting to the cybercriminal group **ExfilSquad**, which allegedly listed the victims on its leak site and claimed the access stemmed from **Microsoft Power Apps** and **Dynamics 365** misconfigurations. Specifically, the group said improperly configured permissions on **Dataverse** tables enabled the data exposure, and the breach was reported after a separate recent compromise involving the **Department for Education**.
Aug 4, 2026
Russian-speaking ransomware group Lynx executed a significant cyberattack against Dodd Group, a major UK Ministry of Defence (MoD) contractor, resulting in the theft and subsequent leak of approximately 4 terabytes of sensitive data. The breach targeted Dodd Group, a Shropshire-based firm providing electrical and mechanical services to British military bases, and exposed confidential information related to both the company and the MoD. The stolen data, which the Lynx group began leaking on their Tor data leak site, includes staff names, email addresses, contractors’ names, phone numbers, car registrations, and MoD personnel contact details. Some of the compromised documents were marked as “Controlled” or “Official Sensitive,” indicating the high level of sensitivity and potential national security implications. The leaked files reportedly contain information on at least eight Royal Air Force (RAF) and Royal Navy bases, including RAF Lakenheath, which hosts US F-35 jets and is believed to house nuclear weapons, RAF Portreath, a NATO radar site, and RAF Predannack, the UK’s National Drone Hub. Visitor logs for RAF Portreath and RNAS Culdrose were among the documents exposed, raising concerns about operational security and the safety of military personnel. The attack was described as “catastrophic” by The Daily Mail, highlighting the scale and impact of the breach. The Dodd Group, which employs over 1,100 people and operates across multiple sectors, confirmed the cyber incident and is cooperating with authorities. The UK Ministry of Defence has launched an investigation into the breach, emphasizing its robust and proactive approach to cyberthreats but declining to comment further on operational details. The Lynx group, considered a successor to the INC criminal operation, reportedly began leaking the data after failed negotiations with the victim. The breach has raised alarms about the security of third-party contractors and the potential exposure of sensitive military infrastructure and personnel information. The incident underscores the growing threat posed by ransomware groups targeting critical defense supply chains. The leak of documents related to ongoing projects, such as the installation of oil tanks and new lighting at military bases, further illustrates the operational risks introduced by such breaches. The exposure of sensitive data could have long-term implications for the security posture of the UK’s defense sector. Authorities are assessing the full extent of the compromise and working to mitigate potential risks to national security and military operations.
Jun 29, 2026