Some Afghan nationals affected by a Ministry of Defence (MoD) data breach are now being targeted by a sophisticated scam email, falsely offering compensation of £86,000. The MoD has confirmed the message is fraudulent and categorically denied any involvement.
The phishing email, written in poor English and riddled with grammatical errors, claims to be from the “Afghan Relocation and Assistance Policy Casework Team” at the MoD’s Head Office.
It instructs recipients to present ID documents in order to collect a cheque from their local building society. However, officials have stressed this is a scam designed to exploit vulnerable individuals impacted by the leak.
Crucially, the scam suggests the sender has access to the leaked personal details of Afghan Relocations and Assistance Policy (ARAP) applicants – raising fresh concerns about who holds the sensitive data of thousands of individuals and how it may be used.
A MoD spokesperson issued a statement saying: “This email has not been sent by the Ministry of Defence or any part of the UK government. Following the February 2022 data incident, appropriate steps have been taken in line with assessed risk. We will robustly defend against any legal action or compensation claims.”
The scam message reads: “We are sincerely sorry for the impact the recent data breach has had on you and your family. As a result we are offering you compensation for £86,000… Please take your id documents to verify your identity, otherwise you won’t be paid.”
Phrases such as “we have shared your detail with bank” and an urgent tone around payment are clear indicators of phishing attempts. The email also contains several tell-tale signs of scam communication, including inconsistent grammar and suspicious formatting.
The email campaign follows the massive MoD data leak in February 2022, in which the personal information of nearly 19,000 ARAP applicants was inadvertently shared by a defence official.
Details were later discovered on a Facebook group in August 2023, prompting a super-injunction in September that temporarily blocked any media coverage.
Defence Secretary John Healey has since issued a formal apology, describing the incident as a “serious departmental error.” Around 6,900 individuals – including those named in the breach and their families – are now being relocated to the UK under the ARAP scheme. The MoD estimates the relocation costs linked to the breach will total approximately £850 million.
In a prior statement, the MoD reaffirmed: “We will robustly defend against any legal action or compensation. The independent Rimmer review concluded it is highly unlikely that simply being on the spreadsheet would lead to targeting, which formed the basis for the court lifting the super-injunction.”
