← All resources

Belgian tax portal attacked: deadline moved (28/10/2026)

Published November 3, 2026 · 7 min read · CyberNovaLabs.io

Four days without MyMinfin, Tax-on-Web or Biztax, and a filing deadline that did not move. No data was stolen, so the cost sits elsewhere. What the Belgian tax portal cyberattack changes in practice for an SME in Belgium, France, the Netherlands and Luxembourg.

In brief

On Wednesday 28 October 2026, Belgium's federal tax administration was hit by a cyberattack and took MyMinfin and several digital services offline as a precaution, Tax-on-Web and Biztax among them^[1][2]. The platforms were reachable again on the evening of Saturday 31 October, and the administration states that no data was stolen and that no application was taken over by the attacker^[2]. For companies the consequence fits in one line: returns covering specific income, due on 31 October, can be filed until 16 November 2026^[1][2].

The expensive part was not the leak

No data left the building, and that is the reassuring headline. It is not the one that matters to a managing director. Between 28 and 31 October, for nearly four days, an administration stopped accepting mandatory filings. You could not fix the outage, apply a patch or switch supplier: the only lawful door into the procedure was shut.

This is the kind of IT risk that SME security plans almost always miss. You protect your servers, your backups, your passwords. You forget that a large share of a company's obligations runs through a counter you do not own: VAT through Intervat, corporate tax through Biztax, payroll statements through Tax-on-Web and MyMinfin, social declarations through the payroll agency, payments through the bank. Each counter has its own cut-off date, and none of them is under your control.

So the question is not are we protected? but what do we do on the day the counter on the other side is closed while the deadline stays where it is?

No extension is automatic

The move to 16 November is a decision announced by the administration, not a right triggered by the outage^[1]. The distinction matters: a company that had assumed an extension without checking the official notice would have been betting on a tolerance nothing guaranteed.

It is not this year's first episode either. In July 2026, technical problems on Tax-on-Web already pushed a deadline from 15 to 19 July^[3]. Twice in four months an extension was granted after an incident; twice, you had to wait for the announcement to know it.

The rule differs by country, and there is no mechanism common to the four markets that turns an outage into a general extension.

This is not legal advice: for a specific situation, the notice published by the relevant authority and your tax adviser decide.

Your proof of attempt is your only defence

When a penalty waiver is discussed, it is discussed on documents. The site was down is not a document. These are, and they cannot be reconstructed afterwards:

• a screenshot of the error message, with the URL visible and the machine clock visible;
• the time of each attempt: three tries at three points in the day beat a single one;
• the administration's official notice, saved as a PDF on the day it is published, because a news page gets rewritten;
• the written exchange with your accountant: who was due to file, at what time, and what they observed;
• once service is restored, the filing receipt and its number, filed together with the outage screenshots.

Five minutes of evidence on the day outweighs a two-page argument three months later. If an accounting firm files for you, this discipline is theirs, and it belongs in the engagement letter alongside the security duties NIS2 now pushes down to Belgian accounting firms and fiduciaries.

If the incident hits you, your clock starts

The case cuts both ways: a company under attack has deadlines too. In Belgium, an entity qualified as essential or important under NIS2 must send the CCB an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours, then a final report within the month; the deadline is 24 hours for trust service providers^[4][5]. Whether you are in scope is assessed entity by entity, not by sector alone.

Those hours get lost working out who tells whom. The volume is not theoretical: reports run into dozens of organisations this year, as our review of data breaches reported to the CCB showed.

At CyberNovaLabs.io

We work with SMEs in the Netherlands, Belgium, France and Luxembourg on exactly this point: turning deadlines and external dependencies into monitored circuits that warn you before the cut-off rather than after. It sits in our AI and automation for business offer: dated reminders, filing evidence kept automatically, an alert when a third-party service stops answering. If you also work the Belgian market, our page on B2B appointment setting in Brussels sets out the method. To discuss it, get in touch with CyberNovaLabs.io: we look at your deadlines and tell you what can be automated. Pricing is quoted per project.

Sources

1. SPF Finances - Incident de cybersecurite au SPF Finances (28/10/2026)
2. RTBF - Les sites du SPF Finances, MyMinfin, Tax-on-Web et Biztax sont a nouveau accessibles (31/10/2026)
3. RTBF - Problemes techniques chez Tax-on-web : le delai est prolonge jusqu'au 19 juillet (13/07/2026)
4. CCB - Guide sur les notifications NIS2, version 1.3 (08/2025)
5. CCB Safeonweb - La notification des incidents NIS2

Read next