The Ministry of Defense has commissioned an investigation into the cause of the IT malfunction and its consequences.
Internal reports from the Bundeswehr and situation information show that the disruption in September affected almost all reservists, whose data including user accounts were deleted.
The full repair is expected to take until at least mid-2027.
Opposition politicians criticize the BWI's information policy and call for comprehensive information, as the incident poses significant risks for the defense capability and the trust of NATO partners.
Berlin. The IT incident at the Bundeswehr in September was more serious than previously officially claimed. This is suggested by internal electronic messages and reports from the Bundeswehr's state commands.
“Situation information” from the IT coordination centers from the beginning of October also paints a much more serious picture of the disruption. They are available to the Handelsblatt.
Likewise, a response from the Federal Ministry of Defense to a new inquiry from Handelsblatt suggests that the case was indeed problematic. The ministry explained that it had commissioned “an investigation that will shed light on the course of the disruption and the disruption caused by the disruption in detail”.
“Measures” were also taken “in close coordination” with the Bundeswehr’s IT service provider, BWI GmbH, “to reduce the likelihood of such disruptions and – should they still occur – mitigate their effects.”
At the end of September, the Handelsblatt reported that tens of thousands of reservists were affected by an IT breakdown. There had been corresponding information from the troops.
Insiders quoted statements from the operational command of the Bundeswehr. Accordingly, data sets were deleted during a mass data import.
The affected reservists no longer had access to computers, official data or emails. In the case of defense, this would be “a catastrophe,” it was said.
After initially admitting problems, a spokesman for the BWI later explained that at most “around 900” reservists were affected. A spokesman for the Ministry of Defense referred to established emergency procedures.
These would “ensure the Bundeswehr’s ability to act without restrictions”. Since an end to the disruption was foreseeable, the emergency procedures were not used, he explained at the time.
But internal reports from the Bundeswehr paint a more problematic picture. Since September 22nd, the first reports have been received that reservists were no longer able to log in to the Bundeswehr's IT system, according to the situation report from a state command. A review revealed that it was a “nationwide disruption.”
This affected all reservists who were not on active duty at the time. All members of the district liaison commandos as well as the reservists on staff were also affected, a total of around “120 to 130”. A “complete deletion of the data records of the affected reservists” was found.
“A disaster for the soldiers affected”
Another command reported that after the IT failure became known, the BWI created a so-called “master incident” in order to record and process the disruption centrally. Those affected could have contacted this number.
In an “escalation meeting” at the state command, it was explained that “almost all reservists” were affected. Exercises had to be “cancelled”. It was “a disaster for the soldiers affected”. The departments would have had to spend “hundreds of hours” to “somehow fix” the IT damage.
In a situation briefing from the beginning of October it was said that personal data of reservists had been “incorrectly” deleted, “which also affected the follow-up systems”. User accounts in the Microsoft Active Directory directory service were also deleted.
As a result, those affected would have lost access to the intranet and their personal email inboxes. The cause was “still” unknown at this point. Possible causes were “incorrect interface programming” or a “maintenance error” in the human resources management system. The BWI initiated an “examination of the entire system” – and found a solution to the problem in mid-October.
User access would have had to be recreated, according to a management report. “To ensure the secure transmission of the passwords, letters were sent to all heads and deputy heads of the district liaison commands,” it continued.
IT staff then restored the ability of those affected to work via remote maintenance. “It was not possible to restore the contents of personal email inboxes,” it said. “This data is largely lost.”
The commandos were now “at least partially operational again,” it was said at the beginning of November. However, it could still be months before all other users have access to the systems again. Due to the complex process, it will “drag on into at least the first half of 2027”.
The Ministry of Defense did not want to confirm what happened when asked. There is “no change in knowledge about the cause or effects of the disruption,” it says. And: “A permanent deletion of data or data sets can currently be ruled out.”
The Green Party deputy Konstantin von Notz reacted to the new findings with clear criticism. “We note with some surprise that the extent of the IT security incident appears to be much larger than was previously known,” von Notz told Handelsblatt.
If this were to be the case, the BWI's information policy would be “absolutely inadequate”. The role of the Federal Ministry of Defense must then also be questioned, he said.
In view of the breakdown, CDU security politician Roderich Kiesewetter warned of significant risks to Germany's defense capability. “If communication is disrupted and, for example, reservists cannot be reached or command and information chains do not work, national defense is massively restricted,” Kiesewetter told the Handelsblatt.
The Green Party's defense and digital politician, Jeanne Dillschneider, explained: "Especially in view of the growing threats from cyber attacks, we certainly cannot afford such failures and must ensure that errors are corrected as quickly as possible."
