The UK left behind sensitive technology allowing the Taliban to track down Afghans who worked with western forces, a whistleblower has told the Afghan leak inquiry.

The woman, known as Person A, said that Afghans affected by the data leak were told to move homes and change their phone numbers to protect themselves from the Taliban because it had the resources to track them down.

MPs are looking into the Conservative government’s handling of a catastrophic leak of the personal details of almost 19,000 Afghans who had asked to come to the UK to flee the Taliban.

A spreadsheet containing their personal data, including names, contact details and in some cases family information, was accidentally leaked by an official working at UK special forces headquarters in February 2022.

The leak came to light only in August 2023, when the names of nine people who had applied to move to the UK appeared on Facebook. Person A, an independent volunteer caseworker who was working with targeted Afghans, was alerted to this and notified the Ministry of Defence.

“There seems to be this misconception that the Taliban do not have the same sort of facilities that we have,” she told MPs on the defence select committee at a private hearing on 18 November, the transcript from which was published on Friday.

“We left it all behind in Afghanistan; they have it. If they have your phone number, they can trace you down to within metres. That is what the [redacted] unit did.”

Asked by Jesse Norman, the Conservative MP for Hereford and South Herefordshire, whether the Taliban possessed the necessary encryption and de-encryption technologies, Person A said: “They’ve got everything.”

Asked by Norman to clarify whether “we left them sensitive material and kit which they were then using against us?” she responded: “Yes.”

Preliminary research submitted to the inquiry last month estimated that at least 49 family members and colleagues of Afghans affected by the leak had been killed.

A superinjunction about the leak was put in force in August 2023 and prevented any information about it from being made public until July 2025.

Person A told MPs that she was served the injunction on 18 September 2023 during a Teams call with the government, without being offered any legal advice.

She had alerted James Heappey, then the Conservative armed forces minister, and Luke Pollard, his Labour counterpart, about the leak by email on 13 August 2023. She received no reply from Heappey until 28 August 2023, when she tagged him in a post on X.

skip past newsletter promotion

Our morning email breaks down the key stories of the day, telling you what’s happening and why it matters

Privacy Notice: Newsletters may contain information about charities, online ads, and content funded by outside parties. If you do not have an account, we will create a guest account for you on theguardian.com to send you this newsletter. You can complete full registration at any time. For more information about how we use your data see our Privacy Policy. We use Google reCaptcha to protect our website and the Google Privacy Policy and Terms of Service apply.

Because she was restricted by the injunction, Person A and the non-governmental organisation she was working with told Afghan families they were working with that they had “concerns that somebody’s phone had been compromised”.

“We recommended that they moved if they could and changed their phone numbers. Those were the two main details that, if the Taliban had access to this information, would lead to them being traced,” she said.

Person A argued that Paul Rimmer, a retired civil servant who carried out a review into the breach, had been wrong to conclude that the acquisition of the dataset by the Taliban was “unlikely to substantially change an individual’s existing exposure given the volume of data already available”, and that it was unlikely “merely being on the dataset would be grounds for targeting”.

“The thing to remember is that these Afghans are not standing up to the Taliban; they are in hiding. Everything boils down to their previous employment. They do not just target the principal applicant; they target the families,” she said.

“We have people who have been electrocuted. We have people who have been waterboarded. We have people who have been whipped with the big outdoor electrical cables that are around the thickness of your fist … We have had four-year-old children who have had their arms broken to try to get the family to say where someone is.”