Would you elaborate more on the background of this? Were the SIM cards sold and registered with a private company? I would suspect it is (or they were, if more than one). Which national defense agencies are you referring to? Did the national defense agencies search these records? Do you assume the agencies have access to this information by default? If it's through a private company, should the agencies have access by default? Do you think the private companies should have contacted the agencies if they didn't have access?

There are answers to these questions, some of them factual, some of them ethical or legal, and up for debate. In only a few situations I think it would be fair to call the agencies "so dumb". What leads you to use those words?

https://english.atlatszo.hu/2016/11/08/illegal-trade-of-burn...

https://www.bloomberg.com/news/articles/2017-01-05/deutsche-...

In the communications act there was a provision about suspicious registrations reporting requirement.

The big providers (like Telekom, a subsidiary of Deutsche Telecom) have a well established working relationship with the defense agencies (they are called national security services, there are a few of them in Hungary, some are focusing on Internal Affairs (counter intelligence), some are on conspiracies, etc.

Expecting perfection out of the gate--or even at any given time--is setting someone up for failure. If this is something you care about, what you can focus on is that they're making changes to improve the situation: they're actively responding to correcting and preventing these kinds of mistakes in the future. Unless they're omniscient and omnipotent, it's really all they can do. This applies to work in general, not just security.

Eventually they'll fix this "security hole", but they won't magically become hyper-competent :/