On the basis of a report by the Comptroller and Auditor General (C&AG), we took evidence from the Ministry of Defence (the Department) on the circumstances surrounding the February 2022 data breach and the Department’s subsequent response, including setting up the Afghanistan Response Route (ARR) to relocate affected individuals.1 Since our session on 8 September we have received a letter, dated 7 October 2025, containing detailed information about all the data breaches between 2021 and October 2025 which should be read in conjunction with this report.2