Cyberattack Takes Down Belgium’s MyMinfin Tax Portal Ahead of Filing Deadline
What Happened — Belgium’s Federal Public Service Finance (FPS Finance) forced its primary online tax portal, MyMinfin, offline on Wednesday after a cyberattack disrupted the service just days before the October 31 filing deadline. The ministry has not identified the attacker or the exact entry point, and it says there is “no indication that a data breach has occurred.” Authorities are investigating the incident, extending filing deadlines for affected taxpayers, and keeping other government applications running. The outage follows an earlier alert about critical PHP vulnerabilities that prompted temporary shutdowns of several Belgian government sites, though a direct link to those flaws has not been confirmed.
Why It Matters for Trust & Control Assurance — The event tests an organization’s incident‑response and business‑continuity controls, a single control objective that maps to many frameworks (e.g., NIST CSF 2.0). Demonstrating that you can detect, contain, and recover from service‑disrupting attacks is a core trust signal.
Who Is Affected — Public‑sector finance agencies, tax authorities, and any entities that rely on the MyMinfin portal for filing and reporting.
Recommended Actions
- Review and exercise your incident‑response and business‑continuity plans for critical public‑service applications.
- Verify that logging, monitoring, and evidence‑preservation processes are in place to provide defensible audit trails.
- Align your response procedures with the “incident response and recovery” control objective in your framework of record.
Technical Notes — The attack’s vector remains unknown; investigators are assessing whether it leveraged the recently disclosed PHP remote‑code‑execution vulnerabilities. No data exfiltration has been reported. Source: The Record