Emerging ThreatsData Breaches

Belgium's Tax Agency Hit by Cyberattack, Disrupts Online Services

Analyst 207||Source: TheRegister
Belgian government office interior with subtle tech infrastructure in daylight.

"Data protection is a top priority for the FOD Financiën," the agency said, after confirming a cyberattack that forced it to pull several of its online services offline while investigators work to secure systems.

FOD Financiën confirms attack and immediate containment steps

Belgium's federal finance and tax agency, FOD Financiën, acknowledged on Wednesday that it had suffered a cyberattack and taken multiple digital services offline. In a public announcement the agency said the move was intended to "limit the risks and makes it possible to carry out the necessary technical interventions to ensure the security of our systems." The statement described the situation as an early-stage investigation and stressed that contingency steps were underway.

MyMinfin and other services taken offline; many apps retain partial functionality

FOD Financiën named MyMinfin — "the agency's main online tax portal" — among the services temporarily unavailable, and said "several" digital services were pulled while teams work. The agency added that "a large part of our other applications remains available with full or partial functionality," and that staff were "closely monitoring the situation" as they worked to restore the affected services.

Tax filing deadline moved from October 31 to November 16

The agency warned that the outage "has consequences for tax deadlines in the near future," specifically referencing the October 31 extended filing deadline that applies to certain income types. FOD Financiën said that deadline will be extended to November 16, and that MyMinfin — through which such filings would normally be submitted — should be back up and running by that date. The extension explicitly covers filings such as those from sole traders and earnings from foreign companies.

Spokesperson Francis Adyns: attack contained within hours, no signs of data compromise

Spokesperson Francis Adyns told local outlets the incident was "thwarted within hours" and that attackers were unable to gain access to applications or data. "The attack could not be sufficiently expanded within our environment to take over applications or gain access to data," Adyns told Nieuwsblad. He said "elements that were potentially infected were isolated" and that, as a consequence, MyMinfin, Tax-on-web, and Biztax went offline while the threat was neutralized.

FOD Financiën's public statement echoed that account: "At present, there are no indications that a data breach has occurred or that data has been compromised. This aspect is also being closely investigated and followed up." Adyns warned that restoring services will be done "in an isolated environment" and that the process "requires considerable time to realize, with the necessary caution to rule out new risks."

What this means for sole traders, FOD Financiën, and taxpayers filing foreign-company income

  • Sole traders and others with the October 31 extension: They will have until November 16 to submit filings that would normally go through MyMinfin, Tax-on-web or Biztax, and should plan on using those platforms once FOD Financiën has restored them.
  • FOD Financiën: The agency has prioritized containment and technical interventions, isolating potentially infected elements and restoring services in an isolated environment while it investigates whether any data was accessed.
  • Taxpayers more broadly: Many other FOD Financiën applications remain available with full or partial functionality, but users of the named portals should expect limited access until the agency confirms full restoration.

The record released by FOD Financiën frames the incident as contained and under active review: services were pulled to reduce risk, potentially infected components were isolated, and the immediate filing deadline was extended to give users time to submit returns once systems return. The agency's repeated insistence that "data protection is a top priority" and that there are currently "no indications" of data compromise sets the terms of the inquiry; restoring services in a deliberately isolated environment is the next concrete milestone.

Original reporting: Belgium's tax agency confirms cyberattack, pulls services offline — The Register

CyberattackData ProtectionEmerging ThreatsEuropeGovernment ServicesBelgiumTax AgencyFOD FinanciënOnline Disruption
Related Intelligence

Continue Reading

Empty laptop screen on a clutter-free desk with soft natural light and blurred background decor.

Chrome Extensions Hijack 13.4M Users' Searches for Ad Revenue

A shocking 319 Chrome extensions, installed by 13.4 million users, have been secretly hijacking search queries to line their creators' pockets with ad revenue from major search engines like Bing and Yahoo. These sneaky extensions quietly took control of users' browsers, routing every search query through a proxy server to collect referral payments.

Analyst 207
Cluttered tech workbench with laptop, papers, and coffee cups, laptop screen showing abstract code.

Malware Exploits AI Apps to Deploy Crypto Miners

Malware operators are sneaking crypto miners into fake AI apps, like bogus desktop versions of Claude and ChatGPT, using clever tricks like a 12.73-day delay to evade detection. These malicious apps are being spread through fake GitHub projects and websites, hiding a crypto-mining payload in plain sight.

Analyst 207
A network operations center with computer workstations, servers, and a city view, with an empty laptop on a nearby table.

Malware Exploits OpenAI Keys for AI Queries

Malware has been discovered that exploits stolen OpenAI keys to secretly run AI queries, racking up bills for unsuspecting victims - with one variant capable of executing over 52 commands. This sneaky malware, detected by Cisco Talos, uses a Go-based implant to route requests through compromised machines.

Analyst 207
Modern Asian government building façade with subtle tech hints.

NetamLoader Exposes Sophisticated APT Attack on Asian Governments

Kaspersky analysts uncovered a highly sophisticated APT attack targeting Asian governments, using a custom .NET-based loader called NetamLoader to infiltrate a unique Windows 10 build. The attack began with a malicious CAB archive cleverly hidden in the Windows update cache, showcasing a cunning tactic to gain a foothold in high-security environments.

Analyst 207