We asked the Department how it obtained assurance that those put at the highest risk from the data breach were identified and contacted.14 The Department told us that it undertook a risk assessment almost immediately after the breach was discovered, to understand which individuals were at highest risk, what that risk was and what the Department could do to mitigate it.15 The Department said that this was a difficult exercise which took many months because of the way the data were stored in the spreadsheet. The Department told us that there are a “handful” of principal applicants whom it has not yet contacted. The Department said this was because identifying people in Afghanistan is not straightforward and that, once it had identified an individual, it was difficult to make contact because some of the contact details that the Department holds are out of date.16