After discovering a cyberattack two weeks prior, the Netherlands’ finance ministry took several systems offline, including the online portal for treasury management.

The ministry revealed last week that the security incident on March 19 did not affect systems involved in managing taxes, subsidies tied to income, or import/export rules for citizens and businesses.

While some staff were affected by the breach, the ministry didn’t say how many or if the attackers had stolen any sensitive data. No group has claimed responsibility for the attack.

In a message to parliament on Monday, Finance Minister Eelco Heinen announced that on March 23, the ministry had shut down certain systems as a security measure, impacting hundreds of Dutch public organizations like ministries, government bodies, schools, social organizations, and local councils.

“For security and due to an ongoing security investigation, some systems, including the online portal for treasury activities, have been temporarily disabled. Consequently, about 1,600 public institutions that have funds with the Finance Ministry cannot currently check their balances online,” Heinen stated.

He added, “Also, users are temporarily unable to submit applications for loans, deposits, or credit via the portal, adjust intraday limits, or create reports.” He clarified, “It is important to note that participants still have complete access to their funds, and payments are being processed as usual through standard banking channels. Where required, basic services will be provided manually to ensure essential functions continue to operate.”

The NCSC and external cybersecurity experts are assisting with the investigation. The ministry has told the Dutch Data Protection Authority (AP) about the breach and alerted the Dutch police’s High Tech Crime Team.

The Finance Minister could not offer a specific timeframe for concluding the investigation or resolving the system outages.

The National Police Corps also experienced a breach in September 2024 by a state-sponsored actor, resulting in the theft of work contact details for an unspecified number of police.

More recently, in February, Dutch authorities arrested a man, aged 40, for asking for compensation in exchange for deleting confidential documents that the police mistakenly shared.