Dutch Ministry of Finance breach

On Thursday 19 March 2026 the IT security team of the Dutch Ministry of Finance noticed unauthorized access to systems used for a number of primary processes at the policy department. An investigation began at once. On 23 March the ministry blocked access to these systems and published a short public notice.

The ministry later said the actor used a weak spot in software that was unknown at the time and had no security update. The incident was related to systems that run for the ministry at a specific supplier. The supplier acted the same day. The supplier is not named in the sources we opened.

On 18 June 2026 the ministry said all restrictions were lifted and all systems were back online. It also said data theft was plausible, although it expects it cannot be reconstructed which files were involved.

What the sources say

The ministry says the incident was related to the systems that run for Finance at a specific supplier. The actor had access to a weak spot in the software that was unknown until then and for which no security updates existed yet.

What the sources do not say

The sources we opened do not name the supplier or the software. They do not give a vulnerability number (CVE), a way in, tools used or the actions taken inside the network. We therefore list no MITRE ATT&CK techniques.

Why it is hard to trace

The ministry says it is not expected to be possible to reconstruct which files were involved, because actors in such cases often wipe their traces.

No public attribution. The ministry's 18 June 2026 look-back speaks only of "een actor" (an actor). No official source we opened names a group, a country or a motive.

The ministry says the impact was limited to the systems and work of the policy department. Tax Authority, Customs and Benefits services to citizens and companies were not affected (23 March notice).

Access to the affected systems was blocked, which affected part of the staff. According to the 30 March letter, several systems were taken out of use, including the digital portal for treasury banking. About 1,600 public bodies could not see their treasury account balance online and could not request loans, deposits or credit, change the intraday limit or run reports via the portal. They kept full access to their funds, and payments went through normal bank channels.

In June the ministry said the intrusion caused no damage to the systems, but that data theft is plausible. Affected staff were informed and supported. The Spring Memorandum process and spring decision-making went ahead.

Systems were fully back online by 18 June 2026.

• 19 March 2026: the supplier took measures the same day and closed certain facilities, in consultation with the ministry.
• 23 March 2026: access to the affected systems was blocked; the ministry published a short notice.
• 30 March 2026: the minister told the House that NCSC and forensic experts were involved, that a report was filed with the police High Tech Crime Team, and that the data protection authority was pre-notified. A confidential technical briefing was offered.
• March to June 2026: an internal crisis organization met daily with technical experts and a management table. The ministry worked with the supplier, outside security experts and the NCSC. Passwords of all policy department staff were reset as a precaution.
• 18 June 2026: after forensic checks found no indicators that the applications were compromised, they returned with extra security checks. All systems were online again. The ministry is evaluating the incident for its continuity and crisis plans and says concrete measures are not public.