The House of Commons Defence Committee has concluded that the Ministry of Defence's 2022 Afghan data breach was a "foreseeable systemic" failure, in a report that accuses the government of years of delay, secrecy and flawed decision-making over Afghan resettlement schemes.

The report, published on 29 July 2026, found that the breach on 22 February 2022 — in which sensitive data belonging to Afghan nationals was compromised — was the result of administrative practices that should have been identified and corrected before any harm was done. The MoD had been using Excel spreadsheets to handle Afghan data, a practice criticised during the committee's inquiry as wholly inadequate for the sensitivity of the material involved.

The committee's findings are damning on multiple fronts. It described the government's long-standing policy of not commenting on special forces matters as "inappropriate" in the context of the breach, and stated that special forces involvement "should not prevent Parliament and the public from understanding how administrative failings occurred" (Defence Committee, parliament.uk).

Central to the committee's frustration is the government's "neither confirm nor deny" stance on UK Special Forces (UKSF). The committee said it was unable to establish the connection between UKSF involvement and the breach because of that policy. The committee also questioned the decision not to provide confidential briefings to parliamentarians about the breach. Then-Defence Secretary Grant Shapps pushed back against plans to inform then-shadow defence secretary John Healey of the breach, according to the report (BBC News).

The breach prompted the MoD to launch the Afghan Response Route (ARR) as a remedial measure. But the committee's inquiry ranged well beyond the immediate data incident, examining the wider architecture of Afghan resettlement and the role special forces played in processing decisions.

In February 2024, BBC Panorama revealed that British Special Forces held a de facto veto over applications under the Afghan Relocations and Assistance Policy (ARAP) from their Afghan counterparts. The programme reported that a British Special Forces officer personally rejected 1,585 resettlement applications from Afghans with credible links to special forces in a matter of weeks in 2023, approving none.

The government announced a review of those rejections in 2024 and subsequently overturned 884 decisions affecting former members of Afghan special forces who had served alongside UKSF. The Defence Committee report stated that the "proportion of decisions subsequently overturned demonstrates the seriousness of that failure" (BBC News).

The government closed ARAP to new applications in 2025.

The data-handling failures were not a one-off. By August 2025, the department handling applications from Afghan citizens had experienced 49 data breaches in total, according to evidence disclosed to the Public Accounts Committee (Public Accounts Committee report). Sky News reported the committee's finding that the use of Excel spreadsheets for such data was a key factor in the foreseeable nature of the failure (Sky News).

The Defence Committee's inquiry has been lengthy. It announced in March 2026 that it would hold two final public evidence sessions to conclude its investigation, and held an oral evidence session on 21 April 2026 as part of the inquiry.

The legal ramifications are ongoing. The defence secretary faces a legal challenge at the Royal Courts of Justice from former Afghan special forces personnel who have been unable to reach the UK.

The broader context here is one of institutional opacity meeting parliamentary accountability. The committee's core finding is that the MoD's combination of inadequate data systems, a blanket refusal to discuss special forces involvement, and resistance to informing opposition figures created a compound failure. Each layer of secrecy, on the committee's account, compounded the last: spreadsheets were used because no proper system existed; the breach was not properly investigated because UKSF involvement triggered a blanket "neither confirm nor deny"; and parliamentarians were not briefed because ministers resisted doing so.

For those working in and around Westminster, the report raises pointed questions about the boundary between operational security and democratic oversight. The committee's language is deliberate. Calling the failure "foreseeable systemic" is an assertion that the conditions for the breach were visible, identifiable and unaddressed. The 49 subsequent breaches disclosed to the Public Accounts Committee lend weight to that characterisation. And the committee's insistence that special forces involvement should not be a blanket shield against scrutiny puts down a marker for future inquiries touching on UKSF.

For the Afghans caught in the middle, the consequences have been concrete. The 884 overturned rejections represent people who were initially denied resettlement by a process the committee has now judged to have been seriously flawed. The legal challenge at the Royal Courts of Justice will test whether the government's current posture withstands judicial scrutiny.