Log in Request a demo

Significant cyber incident

Dutch Ministry of Finance breach

The Dutch Ministry of Finance breach began when the ministry found on 19 March 2026 that an unauthorized actor had accessed part of its IT systems.

In short

The Dutch Ministry of Finance breach began when the ministry found on 19 March 2026 that an unauthorized actor had accessed part of its IT systems. The ministry linked it to systems run by a supplier and an unknown software flaw with no security update. Impact was limited to the policy department, but a treasury banking portal used by about 1,600 public bodies was switched off. In June the ministry said data theft was plausible.

Last updated October 2026

What happened

On Thursday 19 March 2026 the IT security team of the Dutch Ministry of Finance noticed unauthorized access to systems used for a number of primary processes at the policy department. An investigation began at once. On 23 March the ministry blocked access to these systems and published a short public notice.

The ministry later said the actor used a weak spot in software that was unknown at the time and had no security update. The incident was related to systems that run for the ministry at a specific supplier. The supplier acted the same day. The supplier is not named in the sources we opened.

On 18 June 2026 the ministry said all restrictions were lifted and all systems were back online. It also said data theft was plausible, although it expects it cannot be reconstructed which files were involved.

Timeline

  1. 19 March 2026

    The ministry's IT security sees unauthorized access to systems at the policy department.

  2. 19 March 2026

    The supplier takes measures and closes certain facilities, in consultation with the ministry (the look-back says "dezelfde dag", the same day).

  3. 23 March 2026

    Systems are switched off after new insights in the investigation; the ministry blocks access and publishes its first notice.

  4. 27 March 2026

    The House of Representatives finance committee asks the minister for a letter on the effects.

  5. 27 March 2026

    The supplier of the affected software informs all its customers about the vulnerability (Kamerbrief, 18 June 2026).

  6. 30 March 2026

    Minister Heinen sends a letter to the House: about 1,600 public bodies cannot see treasury account balances online; police report filed and data protection authority pre-notified.

  7. March to June 2026

    Crisis organization meets daily; forensic checks run; staff passwords of the policy department are reset.

  8. 18 June 2026

    The ministry publishes a look-back and the minister sends a further letter. All restrictions are lifted and all systems are online.

How the attack worked

What the sources say

The ministry says the incident was related to the systems that run for Finance at a specific supplier. The actor had access to a weak spot in the software that was unknown until then and for which no security updates existed yet.

What the sources do not say

The sources we opened do not name the supplier or the software. They do not give a vulnerability number (CVE), a way in, tools used or the actions taken inside the network. We therefore list no MITRE ATT&CK techniques.

Why it is hard to trace

The ministry says it is not expected to be possible to reconstruct which files were involved, because actors in such cases often wipe their traces.

Who says who was behind it

No public attribution. The ministry's 18 June 2026 look-back speaks only of "een actor" (an actor). No official source we opened names a group, a country or a motive.

Impact

The ministry says the impact was limited to the systems and work of the policy department. Tax Authority, Customs and Benefits services to citizens and companies were not affected (23 March notice).

Access to the affected systems was blocked, which affected part of the staff. According to the 30 March letter, several systems were taken out of use, including the digital portal for treasury banking. About 1,600 public bodies could not see their treasury account balance online and could not request loans, deposits or credit, change the intraday limit or run reports via the portal. They kept full access to their funds, and payments went through normal bank channels.

In June the ministry said the intrusion caused no damage to the systems, but that data theft is plausible. Affected staff were informed and supported. The Spring Memorandum process and spring decision-making went ahead.

Systems were fully back online by 18 June 2026.

Government and regulator response

  • 19 March 2026: the supplier took measures the same day and closed certain facilities, in consultation with the ministry.
  • 23 March 2026: access to the affected systems was blocked; the ministry published a short notice.
  • 30 March 2026: the minister told the House that NCSC and forensic experts were involved, that a report was filed with the police High Tech Crime Team, and that the data protection authority was pre-notified. A confidential technical briefing was offered.
  • March to June 2026: an internal crisis organization met daily with technical experts and a management table. The ministry worked with the supplier, outside security experts and the NCSC. Passwords of all policy department staff were reset as a precaution.
  • 18 June 2026: after forensic checks found no indicators that the applications were compromised, they returned with extra security checks. All systems were online again. The ministry is evaluating the incident for its continuity and crisis plans and says concrete measures are not public.

Lessons

  1. Supplier risk reaches the ministry

    The ministry says the incident related to systems run for it at a supplier. Your exposure includes what your suppliers run for you.

  2. Unpatched flaws leave no time to patch

    The flaw was unknown and had no security update. Speed of containment mattered more than patching.

  3. Fast containment limited damage

    The supplier acted the same day and the ministry says this prevented damage to the systems.

  4. Shutting down has a cost

    Cutting connections stopped staff and about 1,600 external bodies from using treasury banking portals. Plan manual fallbacks.

  5. Traces may be wiped

    The ministry expects it cannot reconstruct which files were taken. Good logging kept outside the attacked systems helps.

  6. Cross-team crisis work helped

    The ministry says its mix of security experts, process owners and outside specialists worked well.

What to check in your own organization

  1. Supplier inventory

    List which systems suppliers run for you, and who at the supplier can shut them down and call you within hours.

  2. Emergency shutdown plan

    Decide in advance who may cut connections to an application, and what the manual fallback is for key services.

  3. Zero-day playbook

    Write down what you do when a supplier reports a flaw with no patch: isolate, reset credentials, raise monitoring.

  4. Credential reset readiness

    Test that you can reset passwords for a whole department quickly, as the ministry did as a precaution.

  5. Logging and data theft evidence

    Check that logs are kept somewhere an intruder cannot wipe, so you can tell what was taken.

  6. Notification routes

    Know your national cyber center, police report route and data protection authority pre-notification steps.

  7. Early warning

    Threat intelligence monitoring can flag risk early in plain ways: alerts on newly disclosed vulnerabilities in software your suppliers use, signs of exposed staff credentials, and watching groups or compromised packages that target your sector. It cannot warn of a truly unknown flaw, but it can shorten the time to learn of one once it is disclosed.

Questions

When did the incident happen?

The ministry says its IT security noticed unauthorized access on Thursday 19 March 2026. The first public notice came on 23 March 2026.

Who was behind it?

No public attribution. Official sources speak only of "an actor".

Which software or supplier was involved?

The ministry says the incident related to systems run for it at a specific supplier. The sources we opened name neither the supplier nor the software.

Were citizens or taxes affected?

The ministry says services of the Tax Authority, Customs and Benefits were not affected. The impact was limited to the policy department.

Was data stolen?

In June 2026 the ministry said data theft is plausible, and that it is not expected to be possible to reconstruct which files were involved.

Are the systems back?

Yes. On 18 June 2026 the ministry said the last restrictions were lifted and all systems were online and accessible.

In our research

  1. Most targeted EU sectors in 2025: the ENISA ranking October 2026

Sources

  1. Ministerie van Financiën onderzoekt ongeautoriseerde toegang tot systemen Rijksoverheid.nl
  2. Terugblik cyberincident Rijksoverheid.nl
  3. Cyberbeveiligingsincident ministerie van Financiën (Kamerbrief, 30 March 2026, PDF) Ministerie van Financiën via open.overheid.nl
  4. Kamerbrief over cyberbeveiligingsincident ministerie van Financiën Rijksoverheid.nl
  5. Aan de minister van Financiën - Verzoek om brief over de gevolgen van de ongeautoriseerde toegang tot ICT-systemen Tweede Kamer
  6. Informatie- en communicatietechnologie (ICT) Tweede Kamer
  7. Cyberbeveiligingsincident ministerie van Financiën Rijksoverheid.nl
  8. Cyberbeveiligingsincident ministerie van Financiën: update (Kamerstuk 26 643 nr. 1533, 18 June 2026) Tweede Kamer, via Eerste Kamer
  9. Beslisnota bij Kamerbrief: Cyberbeveiligingsincident ministerie van Financiën (30 March 2026) Ministerie van Financiën, via Eerste Kamer

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Zero-day vulnerability

A zero-day vulnerability is a weakness in hardware, firmware or software that was previously unknown.

Read more