A cross-party group of MPs has concluded that the Ministry of Defence's 2022 Afghan data breach was a "foreseeable systemic" failure, in a report that accuses the government of years of delay, secrecy and flawed decision-making over Afghan resettlement schemes.

The House of Commons Defence Committee — a parliamentary committee that scrutinises defence policy — published its findings on 29 July 2026. The breach occurred on 22 February 2022, when sensitive data belonging to Afghan nationals was compromised. The committee found that the MoD had been using ordinary Excel spreadsheets to handle this data, a practice it described as wholly inadequate for the sensitivity of the material involved.

The committee's findings are severe on several fronts. It called the government's long-standing policy of not commenting on special forces matters "inappropriate" in the context of the breach, and said special forces involvement "should not prevent Parliament and the public from understanding how administrative failings occurred" (Defence Committee, parliament.uk).

Central to the committee's frustration is the government's "neither confirm nor deny" stance on UK Special Forces (UKSF). The committee said it was unable to establish the connection between UKSF involvement and the breach because of that policy. The committee also questioned the decision not to offer confidential briefings to opposition parliamentarians about the incident. Then-Defence Secretary Grant Shapps pushed back against plans to inform then-shadow defence secretary John Healey of the breach, according to the report (BBC News).

The breach prompted the MoD to launch the Afghan Response Route (ARR) as a remedial measure. But the committee's inquiry ranged well beyond the immediate data incident, examining the wider structure of Afghan resettlement and the role special forces played in processing decisions.

In February 2024, BBC Panorama revealed that British Special Forces held a de facto veto over applications under the Afghan Relocations and Assistance Policy (ARAP) — a scheme for Afghans who worked alongside or supported UK forces. The programme reported that a single British Special Forces officer personally rejected 1,585 resettlement applications from Afghans with credible links to special forces in a matter of weeks in 2023, approving none.

The government announced a review of those rejections in 2024 and subsequently overturned 884 decisions affecting former members of Afghan special forces who had served alongside UKSF. The Defence Committee report stated that the "proportion of decisions subsequently overturned demonstrates the seriousness of that failure" (BBC News).

The government closed ARAP to new applications in 2025.

The data-handling failures were not a one-off. By August 2025, the department handling applications from Afghan citizens had experienced 49 data breaches in total, according to evidence disclosed to the Public Accounts Committee — another parliamentary body that examines government spending (Public Accounts Committee report). Sky News reported the committee's finding that the use of Excel spreadsheets for such data was a key factor in the foreseeable nature of the failure (Sky News).

The Defence Committee's inquiry has been lengthy. It announced in March 2026 that it would hold two final public evidence sessions to conclude its investigation, and held an oral evidence session on 21 April 2026.

The legal ramifications are ongoing. The defence secretary faces a legal challenge at the Royal Courts of Justice from former Afghan special forces personnel who have been unable to reach the UK.

The broader context here is one of institutional opacity meeting parliamentary accountability. The committee's core finding is that the MoD's combination of inadequate data systems, a blanket refusal to discuss special forces involvement, and resistance to informing opposition figures created a compound failure. Each layer of secrecy, on the committee's account, compounded the last: spreadsheets were used because no proper system existed; the breach was not properly investigated because UKSF involvement triggered a blanket "neither confirm nor deny"; and parliamentarians were not briefed because ministers resisted doing so.

For those working in and around Westminster, the report raises pointed questions about the boundary between operational security and democratic oversight. Calling the failure "foreseeable systemic" is an assertion that the conditions for the breach were visible, identifiable and unaddressed. The 49 subsequent breaches disclosed to the Public Accounts Committee lend weight to that characterisation. And the committee's insistence that special forces involvement should not be a blanket shield against scrutiny puts down a marker for future inquiries touching on UKSF.

For the Afghans caught in the middle, the consequences have been concrete. The 884 overturned rejections represent people who were initially denied resettlement by a process the committee has now judged to have been seriously flawed. The legal challenge at the Royal Courts of Justice will test whether the government's current posture withstands judicial scrutiny.