Belgium extended selected tax deadlines after a cyberattack took key digital services offline.
Why it matters: The outage disrupted tax administration ahead of deadlines affecting individuals and businesses. Belgium says it found no evidence of data access or leakage, but no independent forensic findings have been published.
- Belgium's finance administration said the intrusion occurred overnight from Oct. 27 to Oct. 28, 2026, and was detected within several hours.
- MyMinfin, Tax-on-web and Biztax were taken offline as a precaution and remained unavailable on Oct. 29.
- The administration extended specified obligations by 16 days, to Nov. 16, 2026.
- The attack vector, perpetrator, motive and restoration timetable had not been disclosed as of Oct. 29.
Belgium's Federal Public Service Finance was infiltrated overnight from Oct. 27 to Oct. 28, 2026. Security tools and monitoring systems detected the incident within several hours, according to the administration's Oct. 28 government statement. No more precise detection time was disclosed, and the incident was publicly described in that statement.
The administration said the intrusion had not progressed far enough to take control of applications or access data. It isolated potentially compromised components and took MyMinfin, Tax-on-web and Biztax offline as a precaution. In its Oct. 29 update, it said there were no data leaks and that the affected services remained offline.
Those are government assessments. The available materials contain no independent forensic report, technical indicators or data-protection authority finding confirming that no data was accessed or exfiltrated.
The administration said it was rebuilding affected services in an isolated environment while excluding further risks. It did not provide a restoration date. Public statements also did not identify the attack method, attacker or motive, or establish a connection to an earlier October alert involving PHP vulnerabilities.
The 16-day extension runs to Nov. 16 and covers the personal and corporate tax obligations, Pillar Two filings, DAC6 and country-by-country filings, withholding-tax returns and other notifications listed in KPMG's summary of the guidance. Pillar Two filings concern global minimum-tax rules for large multinational groups; DAC6 refers to reportable cross-border tax arrangements; country-by-country filings are reports by qualifying multinational groups on their income and taxes across jurisdictions. The available materials do not say whether each listed extension applies automatically or whether taxpayers must take an additional step.
By the numbers
- 16 days - length of the extension for specified tax obligations
- Nov. 16, 2026 - revised deadline listed in the available guidance
- 3 services - MyMinfin, Tax-on-web and Biztax identified as affected
Yes, but: Belgium says there is no evidence of a data leak or data access, but those statements remain provisional government assessments without independent forensic confirmation in the available materials.
What's next: The administration was rebuilding the services in an isolated environment, but had not announced a restoration date as of Oct. 29.