Dutch Finance Ministry investigates cyberattack after unauthorized system access

The Dutch Ministry of Finance confirmed Monday that a cyberattack breached parts of its internal systems, affecting some employees after unauthorized access was detected last week.

The intrusion was identified on March 19 following a notification from a third party. Internal ICT security teams subsequently confirmed that unauthorized access had occurred within systems supporting several primary processes in the ministry’s policy department. Access to the affected systems has since been blocked as authorities continue their investigation.

Officials said the disruption has impacted a portion of ministry staff, though the total number of affected employees has not been disclosed. The scope of the breach, including whether any sensitive data was accessed or exfiltrated, remains under review.

The ministry emphasized that critical public-facing systems remain unaffected. Platforms used for tax collection, import and export regulation, and income-linked subsidy programs continue to operate normally. These systems process more than 9.5 million annual income tax returns and support essential services delivered by the Tax and Customs Administration, Customs, and Benefits divisions.

Authorities have not attributed the attack to any known cybercrime group, and no threat actor has publicly claimed responsibility. Officials declined to provide further details on the duration of the intrusion or the methods used, citing the ongoing investigation.

The incident follows a series of cybersecurity events involving Dutch government entities. In September 2024, the Politie experienced a breach linked to a suspected state-backed actor that accessed work-related contact information of police personnel. In February, Dutch authorities arrested a 40-year-old man in connection with an extortion attempt involving confidential police documents that had been inadvertently exposed.