Belgium's FPS Finance says MyMinfin attack leaked no data; deadline for some returns now 16 November

Sixteen days of grace, and a tax portal with no restore date

Belgium's federal public service Finance (FPS Finance) says on its own news page, updated at 15:30 on Thursday 29 October 2026, that its digital services were hit by a cyberattack on Wednesday 28 October, that "le piratage a été stoppé avec succès" (the hack was stopped successfully, our translation), and that the deadline for filing a return with specific income through MyMinfin (Tax-on-web) is now 16 November 2026. That is 16 days after the 31 October date the deadline had carried since 25 September, and 31 days after the 16 October date it carried before that (both derived). The 31 October date was three days after the attack was announced (derived). The agency page was read in the original French and Dutch at 18:30 GMT on Thursday 29 October 2026.

What the fact does not establish is most of what readers will want to know. The agency's page names no attacker, no way in, no list of the systems affected beyond MyMinfin and "several other" ones, no count of taxpayers, and no date on which the portal returns. The Belgian press, relaying a spokesperson, says MyMinfin, Tax-on-web and Biztax are the three services taken offline, and that the intrusion was spotted within hours. The agency's wording on data also moved in 25 hours, from "no indication" of a breach to "we now know" that none occurred, and one English report still carries the earlier wording.

This briefing reads the agency's own pages first and the press second. It is a record of what is stated and by whom, not a finding about the attack.

What was read, how, and what was not

The primary is FPS Finance's citizen site. Its news item "Incident de cybersécurité au SPF Finances" (French, Dutch) carries a publication date of 28 October 2026 and says it was updated on 29 October at 15:30. The agency's filing page, its earlier deadline notice, its September phishing warning and its fraud page were read too, all in French, with the Dutch incident page for comparison. I found no English version of the incident item; the translations in this briefing are ours and are marked as such.

The press reports used are the Belgian ones: VRT (Dutch, first report at 14:23 on 28 October), RTBF (28 October and 29 October, French, both with the Belga agency), and the Brussels Times (28 October and 29 October). The English report that prompted this briefing, The Record of 29 October, was read as well. These are secondary: where they relay a spokesperson, the briefing says so.

Three things were not read, and the briefing does not pretend otherwise. The federal news site news.belgium.be, which the agency's statement is also published on, and the Centre for Cybersecurity Belgium (CCB) site answered the automated fetcher with an access denied page, so neither was read and nothing here rests on them. The Register's 29 October report, a lead for this story, was not read because its robots file excludes this fetcher. Nothing was filled in, no account was created and no bot check was tried.

Zoom

The sequence as stated, step by step

The agency says the attack happened on Wednesday 28 October. Its spokesperson, quoted by Belga, puts the intrusion in the night from Tuesday to Wednesday and says it was detected "within a few hours" (our translation of RTBF's French). Belga reports that the agency identified "several attempts to alter" parts of its digital environment, that potentially infected elements were isolated, and that this is why MyMinfin, Tax-on-web and Biztax went offline. The agency, in its own words, says the attack "could not be developed enough" in its environment to make changes or reach data (RTBF, our translation of a quotation attributed to the administration).

Zoom

Two details are easy to lose. First, the agency says the hack was stopped, yet the services are still off: it says the services "must be restored in an isolated environment" and that this takes time to rule out new risks (our translation of RTBF's report of the agency's words). Stopping an intrusion and bringing a rebuilt service back are different events, and only the first has been announced as done. Second, "a large part of our other applications remains available, with full or partial functions" is the agency's own wording, so what remains offline beyond the three named services is not itemised.

The statement in the original, with our translation

Both language versions of the 29 October update are quoted below exactly as saved, so that a reader who knows French or Dutch can check the translation. The French says the deadline "a été reporté" (has been postponed) and the Dutch says it "wordt uitgesteld" (is being postponed); the dates agree. The French text prints a full stop with no space before "La protection", as the page does.

Les services numériques du SPF Finances ont fait l’objet mercredi 28 octobre 2026 d’une cyberattaque. Le piratage a été stoppé avec succès.

Par mesure de précaution, MyMinfin et plusieurs autres services ont été temporairement mis hors ligne. Le SPF Finances œuvre à un redémarrage mais cela nécessite du temps pour éviter tout risque.

Nous sommes conscients des conséquences que cette situation peut avoir sur les délais fiscaux. Dès lors, le délai pour rentrer sa déclaration d'impôts en cas de revenus spéciaux, a été reporté au 16 novembre 2026.La protection des données est une priorité pour le SPF Finances. Nous savons entretemps qu’aucune donnée n'a fuité.

Une grande partie de nos applications reste disponible, avec des fonctionnalités complètes ou partielles. Nous suivons la situation de près et mettons tout en œuvre pour rétablir les services concernés dans les meilleurs délais.

Our translation of the French (not an official translation): the agency's digital services were the target of a cyberattack on Wednesday 28 October 2026, and the hack was stopped successfully. As a precaution MyMinfin and several other services were taken offline temporarily, and the agency is working on a restart but it needs time to avoid any risk. It is aware of the consequences for tax deadlines, so the deadline for filing a return with special income has been postponed to 16 November 2026. Data protection is a priority, and "we now know that no data has leaked". A large part of its applications remains available with full or partial functions, and it is doing everything to restore the affected services as soon as possible.

De digitale diensten van de FOD Financiën werden op woensdag 28 oktober 2026 getroffen door een cyberaanval. De aanval kon succesvol gestopt worden.

Uit voorzorg werden MyMinfin en enkele andere diensten tijdelijk offline gehaald. De FOD Financiën werkt aan een herstart, maar dat heeft tijd nodig om nieuwe risico's uit te sluiten.

We beseffen dat dit voor de fiscale deadlines in de nabije toekomst gevolgen heeft. Daarom wordt de deadline voor het indienen van de aangiften met specifieke inkomsten uitgesteld naar 16 november 2026.

De bescherming van gegevens staat voor de FOD Financiën voorop. We weten ondertussen dat er geen data zijn gelekt.

Een groot deel van onze andere toepassingen blijft intussen beschikbaar, met volledige of gedeeltelijke functionaliteit. We volgen de situatie nauwgezet op en doen er alles aan om de getroffen diensten zo snel mogelijk opnieuw beschikbaar te maken.

The Dutch version says the same, with one wording difference that matters for filers: it calls the affected returns those "met specifieke inkomsten" (with specific income), the term the filing page also uses, while the French news item says "revenus spéciaux" (special income) and the filing page says "revenus spécifiques". The filing page defines the group as taxpayers using MyMinfin (Tax-on-web) who declare specific income, and gives self employed income and foreign professional income as examples. It does not give a head count.

Stated and not stated

The row that carries the most weight is the data row. It is the agency's own claim, made by the party with the most reason to reassure taxpayers, and it is printed without a method. That is not a reason to think it wrong. It is a reason to treat "no data has leaked" as the agency's finding to date, and to ask what an examination of an environment that was rebuilt in isolation can and cannot see.

The wording moved in 25 hours, and the English report did not

On 28 October, as VRT and RTBF relayed the agency's press release, there was "no indication" of a leak or theft and the matter was being examined, and an extension would be granted with the date to follow. On 29 October at 15:30 the agency's page said it now knew that no data had leaked and gave 16 November. The Record's report of 29 October still carries the first version: it quotes "no indication that a data breach has occurred" and says a revised deadline "to be announced later". I did not find a time stamp on the English report, so it may simply have been written before the update.

Zoom

The lesson is not that the English report was wrong; it reported what the agency had said when it wrote. It is that a statement from an agency in the first 48 hours of an incident is a time stamped state, not a fixed fact, and that the agency's page, with its update time, is the only place a reader can see which state is current. That includes this briefing, which should be read with its read time of about 18:30 GMT on 29 October 2026. The agency may update its page again.

Three dates, one portal: what the deadline notices show

Two oddities are on the agency's own pages and are worth noting for anyone who lands on them. The 25 September deadline notice still says 31 October in its body, though a banner above it points to the incident. And the general filing page opens by telling readers who have not yet filed to do so "via MyMinfin (Tax-on-web)", the very service that is offline, with the same incident banner below. Neither is an error in the usual sense. Both show how a deadline lives in many places and how an outage reaches only the top one.

The filing page also describes the agency's ordinary route for extra time: the request must arrive within the deadline, must rest on force majeure or serious grounds, and can be made by an online form or by contacting the agency. A taxpayer who files late, or not at all, risks a fine or a tax increase, and the agency can tax a person by default ("taxation d'office"), after which the person must prove their income. The agency adds that it takes each case's circumstances into account. What the record does not say is whether the online request form works during the outage, or whether the 16 November date is a legal extension for every affected taxpayer or an administrative tolerance. The legal instrument was not read.

The shape of the dependency is general. A deadline is a date in the law; the means of meeting it is a web service; and the notice that moves the date is published on a web site that may share its fate. Belgium's notice survived because the citizen news site stayed up. A tax agency, a payroll provider or a company with a regulatory filing date should know which of its filing routes has a second path that does not use the same login, the same identity provider and the same portal.

Friendly words: precaution, temporary, stopped, no leak

Four reassuring words carry most of the agency's message. Each is a label, not a control, and each has a question beside it.

The agency also says the affected services must be restored "in an isolated environment". That is a reasonable engineering choice, and it implies that the earlier environment is not simply being switched back on. It also means the day the portal returns is a design decision, not a date on a calendar, which is why the 16 November deadline could be moved again.

The earlier PHP alert, and what has not been linked

Earlier in October, Belgian government sites went offline in response to two critical PHP flaws. The Brussels Times reported on 22 October that the FPS Finance website was among the sites still down that morning, alongside the Centre for Cybersecurity Belgium's own site. The Record's report of 29 October says FPS Finance took many websites offline then because of an "international security issue", and that it remains unclear whether the Wednesday attack is connected. It adds that Belgian authorities have not publicly established any link. I read nothing that does. This site has covered the PHP flaws separately: see the emergency fixes and the alerts and the exploited list entry.

So there are two statements side by side and no bridge between them. The record does not say whether the cause of this attack was a PHP flaw, a stolen credential, a supplier, or something else, and a reader who joins the two events is adding a claim the sources do not make. The CCB, according to The Record, said at the time of the PHP alert that it had received no reports of successful attacks against Belgian sites exploiting the flaws; that is The Record's account, and the CCB page was not readable here.

On the regulatory side, I did not read Belgium's NIS2 law, the official gazette or any CCB page for this briefing, so it says nothing about whether FPS Finance was required to notify anyone, or did. The only statement read is Belga's: that the federal police and the CCB are involved in the investigation. That is not a notification under any law and should not be read as one.

Expect scams, and note how the agency says to check

On 30 September, before the attack, the agency warned of a large phishing campaign in circulation: a fake email appearing to come from its tax conciliation service, announcing a tax refund and asking for personal and bank details. It said at that time that no intrusion into its systems had been found and that there was no data leak, and that the fraudsters only used the agency's name. That statement is about that campaign and that date, not about 28 October.

I found no new scam warning tied to the incident on the agency's news list on 29 October. That is an absence on one page at one time, not a finding that none has been issued. It is, however, the pattern: a public outage plus a deadline is a favourable moment for a fake message that offers a refund, or a new login link, or a payment to avoid a fine. The agency's advice, on its fraud page and its 30 September notice, is to check the sender domain, to distrust urgency and refund offers, and never to give confidential details by email, text or social media; it also says an official sender domain is not proof on its own.

One of the agency's own checks leans on the portal that is offline. Its fraud page says the only original of any document it issues is the one in the taxpayer's online file in MyMinfin, and that a paper or digital document can be checked either by logging in or by scanning a datamatrix to open a copy under an agency address. Whether that document viewer works during the outage was not tested here, and the agency has not said. A taxpayer holding a suspicious letter in the coming days may find the check unavailable. The sensible rule is the one the agency gives for links: do not use the link in the message; type the portal's address yourself, and if the portal is down, wait.

What to do, in order

Technical details

The agency's pages read for this briefing publish no technical artifact about the attack: no vulnerability or CVE, no malware or tool name, no indicator of compromise, no entry route, no configuration and no log line. None is invented here. What the agency does print are the strings a taxpayer can use to check a message, and they are useful to a defender who has to brief staff or customers. They are given below as printed, with the lookalike domains defanged by us.

Official sender domains (as printed):
@minfin.fed.be
@news.minfin.fed.be

Lookalike domains the page gives as examples of phishing (defanged by us with [.]):
@minfin[.]fgov[.]be
@minfin-fed[.]org

Structure of an official payment account (as printed):
BEXX 6792 XXXX XXXX

Address the page gives for reporting a suspect message:
suspect@safeonweb.be

The page also says a document issued by the agency can be viewed, without logging in, by scanning the datamatrix at the top right of the document, which opens an address under eservices.minfin.fgov.be with the path doc followed by the document's unique number. The 30 September notice names the sender address used in that campaign, in the form of the conciliation service's mailbox on the agency's own domain, and says the message did not come from the agency. A defender should treat those as the agency's statement about a spoofed display address, not as a finding about this site's mail servers, and should not assume the 28 October attack is related to that campaign.

What to hunt and harden on the strength of this record is therefore about your own side: mail filtering for the lookalike patterns of any agency you depend on, a short written list of the real addresses and domains for each regulator or tax body your staff deal with, and a rule that a payment or login request that arrives during a public outage is verified by a second channel.

The question the record cannot yet answer

FPS Finance has told taxpayers three things: the attack was stopped, no data has leaked, and they have until 16 November. It has not said when the portal returns, how it knows, or what would move the date again. The sources read name no attacker and no way in, and join the attack to nothing.

So the question for any organisation that files, pays or proves identity through one portal is this: on the day that portal is switched off as a precaution, which of your obligations still have a working route, who is allowed to move the date, and where will you say so?

Key facts