1. Executive summary
Belgium's Federal Public Service Finance (FPS Finance) has taken MyMinfin, the country's main online tax and financial affairs portal, offline after a cyberattack and is investigating the extent of the intrusion, days before an October 31 filing deadline for certain income types. FPS Finance states there is currently no indication of a data breach or data theft, and says it is still examining the possibility of data exposure. No actor has been identified and no access vector has been disclosed. The incident follows an earlier precautionary shutdown of several Belgian government websites this month over two critical PHP remote code execution vulnerabilities, and authorities have not established a public link between the two events. For EMEA financial services the direct exposure is limited to firms and clients that transact with Belgian tax administration through MyMinfin; the material risk is the unpatched PHP exposure that prompted the earlier shutdown, which is not specific to Belgium.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The confirmed sequence is short. FPS Finance detected a cyberattack against systems supporting MyMinfin, suspended access to the portal as a precaution, and opened an investigation into the extent of the intrusion and the possibility of data exposure. The agency has not disclosed the initial access vector, the systems compromised beyond the MyMinfin service boundary, any malware, or any actor. It states that several other government applications remained fully or partially operational, which indicates the shutdown was scoped to the affected services rather than a ministry-wide containment.
- FPS Finance identifies a cyberattack affecting MyMinfin.
- Access to MyMinfin is suspended as a precaution while specialists assess impact.
- FPS Finance investigates the extent of the attack and whether data was exposed.
- Affected taxpayers are granted additional time to file; a revised deadline is to be announced.
Nothing in the source establishes how the attackers gained access, what persistence or lateral movement occurred, or whether data was accessed. The claim that no data breach has occurred is FPS Finance's current assessment, not a confirmed negative; the agency explicitly says investigators continue to examine the possibility of data exposure.
The only technical lead in the source is contextual and unconfirmed. Earlier this month Belgian authorities temporarily shut down several government websites, including FPS Finance sites, over an "international security issue." That shutdown coincided with a broader alert over two critical PHP vulnerabilities that could allow remote code execution on vulnerable servers, and The Brussels Times reported FPS Finance sites were among those affected. Belgium's national cybersecurity centre said at the time it had received no reports of successful exploitation against Belgian websites. The source does not name the two CVEs, does not give affected PHP versions, and does not state whether MyMinfin runs PHP. Belgian authorities have not publicly linked the earlier PHP-driven shutdown to the MyMinfin attack. Treat any connection between the two as unconfirmed; the source presents it as an open question, not a finding.
Attribution: none. No actor, group, or motivation is identified in the source. No MITRE ATT&CK technique mapping is supportable from the facts given, because the intrusion mechanics are undisclosed.
4. Mitigation & containment
P1 within 24h
- Inventory any internet-facing service running PHP and confirm the PHP version against the vendor's current security releases. The source names two critical PHP RCE vulnerabilities but does not give CVE identifiers or affected versions; obtain those from the PHP project's security advisories before acting, and do not rely on this advisory for version numbers.
- Where a PHP version cannot be confirmed as patched, take the service offline or place it behind an authenticating reverse proxy until it is. This mirrors the precautionary approach Belgian authorities took.
- For firms with Belgian tax filing obligations or client money tied to MyMinfin submissions, confirm the revised filing deadline with FPS Finance before the October 31 date and document any late-filing exposure.
P2 within 72h
- Review authentication and access logs for the MyMinfin-adjacent services your firm or clients use, looking for anomalous access in the window before the portal went offline. The source gives no indicators, so this is a hunt for the unknown rather than a signature match.
- Confirm whether any third-party provider in your supply chain hosts or integrates with Belgian government tax services, and ask them for their incident status in writing.
P3 within 7 days
- Add the MyMinfin outage to the incident register with the current "no confirmed breach" status recorded as provisional, pending FPS Finance's investigation.
- Re-test the patch-management path for public-facing web runtimes so that a future PHP-class alert can be actioned within the window the vendor's advisory demands.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source describes no hashes, domains, IP addresses, file paths, or command lines. It names no CVEs for the PHP vulnerabilities and gives no exploitation artefacts. Any IOC set circulating for this incident should be treated as unverified until FPS Finance or Belgium's national cybersecurity centre publishes one.
6. Detection
Insufficient indicators to author detection rules.
The source provides no distinctive strings, command-line flags, file names, registry keys, or network artefacts attributable to the threat. The two PHP vulnerabilities are referenced only generically, with no CVE identifiers or version detail, so a rule built on them would detect reporting about the flaw rather than the flaw itself.
7. Sources
- The Record (Recorded Future News), "Cyberattack disrupts Belgian tax services before filing deadline," by Daryna Antoniuk, 2026-10-29. https://therecord.media/cyberattack-disrupts-belgian-tax-services-before-deadline
All facts in this advisory derive from this single source. The PHP vulnerability context, the earlier government website shutdown, and the "no data breach" statement are all as reported by The Record and attributed to FPS Finance and Belgian authorities; none is independently corroborated here. Single-sourced; verify against FPS Finance and the Centre for Cybersecurity Belgium before acting on the PHP angle.
8. Adverse Trace position
Adverse Trace assesses this as a service-disruption incident with an unresolved data-exposure question, not a confirmed breach. The source gives no CVSS score, no CVE, no actor, and no exploitation detail, so we do not assign a severity rating beyond that: the impact is currently availability of a national tax portal, and the confidentiality impact is unknown. For EMEA financial services clients the direct exposure is narrow (Belgian tax interactions), but the PHP RCE context is the part worth acting on, because an unpatched public-facing PHP runtime is a generic exposure that this incident may or may not share. We will monitor FPS Finance and the Centre for Cybersecurity Belgium for the revised filing deadline, any confirmed data-exposure finding, and any published CVE identifiers for the PHP flaws, and we will update this advisory if attribution or indicators emerge. Clients with Belgian filing obligations should confirm the new deadline directly rather than wait for this note to be revised.
Published via PulseTrace — Adverse Trace threat intelligence.