Cyber Incident Victim: Inflite The Jet Centre

Inflite The Jet Centre, a subcontractor providing ground‑handling services at London Stansted airport, experienced a cyber‑security incident in which unauthorized access was gained to a small number of its email accounts. The compromised emails contained basic personal information, including names, passport details such as date of birth and passport number, and Afghan Relocations and Assistance Policy (Arap) reference numbers. According to the Ministry of Defence, the data of up to 3,700 Afghans who had travelled to the United Kingdom between January and March 2024 under the Arap resettlement scheme were potentially exposed, alongside the personal data of some British military personnel and former Conservative government ministers. The incident follows a separate data breach in February 2022 in which the personal details of nearly 19,000 Afghans who had applied to move to the UK under the Arap scheme were mistakenly leaked by a British official, a matter that was first made public in July of that year.

The UK government stated that the breach had not posed any threat to individuals’ safety and had not compromised any government systems, and that there was currently no evidence to suggest that any of the exposed data had been released publicly. An email sent by the Afghan resettlement team on a Friday afternoon warned affected families that their personal information may have been exposed, specifying that passport details and Arap reference numbers could be involved. Professor Sara de Jong of the Sulha Alliance charity described the breach as astonishing and expressed concern for the safety of Afghans who had worked with British forces, while also urging the Ministry of Defence to expedite pending relocation cases. Former UK national security adviser Sir Mark Lyall Grant called both the 2022 and 2025 breaches deeply embarrassing for the British government, and former Conservative Chancellor Kwasi Kwarteng characterised the incidents as very serious and really concerning for individuals facing possible deportation. Liberal Democrat Defence Spokesperson Helen Maguire accused the government of staggering incompetence and called for an immediate, fully independent investigation into the security breaches.

In response to the incident, Inflite The Jet Centre issued a statement asserting that the scope of the breach was limited to email accounts only and confirmed that it had reported the matter to the Information Commissioner’s Office (ICO), which acknowledged receipt of the report. The Ministry of Defence said it had been recently notified that a third‑party sub‑contractor to a supplier had experienced a cyber‑security incident involving unauthorised access to emails containing basic personal information, and emphasised that it takes data security extremely seriously and is going above and beyond its legal duties in informing all potentially affected individuals. Following a Newsnight interview in which the son of an Afghan special forces member described his family’s imminent deportation after their details were leaked, the Ministry of Defence stated that it was honouring its commitments to all eligible individuals who pass the relevant security and entry checks for relocation, noting that in some cases people do not pass those checks. The deportation of the individual discussed in the interview was subsequently reported, prompting the Ministry of Defence to reiterate its position on security checks and relocation commitments.