Inside the Budget breach: What we know

The National Party's release of Budget information ahead of the official release last week set off a flurry of activity. There were claims of illegal hacking and counter-claims nothing close to illegal took place. Eventually, two separate investigations were launched, accompanied by speculation at least one public servant's job could be on the chopping block.

Newshub has pieced together a timeline of events.

National discovers Budget information

Monday, May 27, 5pm - During a Budget preparation session, a spokesperson for the National Party leader says a staffer "tripped over" information that appeared to be from Budget 2019. They alerted an MP and a researcher.

6pm - After an hour of searching, the MP called the chief press secretary saying that Budget 2019 information appeared to be viewable on the Treasury website.

The small team searched the website, compiling information. They went home at about 10pm or 11pm.

While the National Party says they accessed information from 5pm on Monday - and would continue to do so for more than 20 hours - the Treasury claims its search function was used for 48 hours, which, if accurate, would mean searches took place on Sunday.

National releases Budget details

Early morning Tuesday, May 28 - National double-checked the numbers compiled the previous night, and prepared for a public release.

Meanwhile, staffers continued searching and compiling information.

Gabriel Makhlouf.
Gabriel Makhlouf. Photo credit: The AM Show

10:01am - National leader Simon Bridges released Budget details to media ahead of the official release, scheduled for Thursday.

11am - During the National Party caucus run, some MPs were aware the party had Budget 2019 information. Others seemed oblivious. Among those who said they didn't know about the Budget breach was Judith Collins.

1pm - Grant Robertson and Treasury Secretary Gabriel Makhlouf met to discuss the accuracy of National Party numbers.

1:34pm - Following further searches of the website, National released more information, including funding for agriculture and biosecurity.

1:50pm - Grant Robertson told journalists "some of [National's information is] right, some of it is wrong" on his way into the House. Budget documents would eventually prove the information largely accurate.

2pm - National found the Budget information was no longer accessible on Treasury's website.

4.31pm - National released more information, including the Treaty of Waitangi negotiations spend and that a Mental Health Commission would be confirmed in the Budget.

7:15pm - Robertson met Makhlouf at the Beehive for around 20 minutes. Robertson says during the meeting, Makhlouf told him he'd referred the "hack" to police.

7:55pm - Newshub broke the news Treasury referred the "hack" to police.

At some point prior to 8:03pm, the GCSB warned Minister Andrew Little it did not believe Treasury had been hacked, according to reports from NZME. Little has confirmed he was briefed by the GCSB but has not confirmed when.

Simon Bridges.
Simon Bridges. Photo credit: Getty

Treasury issues statement saying it was hacked

8:03pm - A statement from Treasury was sent to all media saying it had "gathered sufficient evidence to indicate that its systems have been deliberately and systematically hacked".

This would later be found to be a vast overstatement - a search tool was either utilised or exploited, depending on who you speak to, in order to piece together Budget 2019 information.

Robertson calls on National to not release any more information

8:19pm - Robertson's office says he issued a statement calling on National to not release more information before he knew the GCSB held concerns about describing the information breach as a "hack".

Robertson says he was relying on advice from Makhlouf, and that the GCSB did not contact him directly.

Robertson's statement on the Treasury statement described the matter as "extremely serious" and "a matter for the police". He called on National to not release any further information.

Robertson's office did not confirm when Robertson was advised the information should not be described as a hack, saying that was for the State Services Commission (SSC) inquiry to go into.

Makhlouf claims 'multiple and persistent' attempts to gain 'unauthorised access'

Wednesday, May 29, 7:40am - Makhlouf appeared on The AM Show, saying more than 2000 attempts were made to "gain unauthorised access to Budget information", likening the attempts to working at a bolt on a locked room.


This was the same day teachers took part in a "mega-strike" across the country, dominating headlines.

But the political mudslinging continued.

Bridges claimed Robertson "lied", Robertson claimed Bridges was "desperate", and Winston Peters claimed the National Party got the figures "in circumstances that were totally illegal."

Bridges claimed there was "nothing illegal or even approaching that".

Grant Robertson.
Grant Robertson. Photo credit: Newshub.

Treasury admits it was not hacked

Thursday, May 30, 5:05am - On the morning of the Budget release, Treasury issued a statement saying it was not hacked and police would be dropping the investigation.

It admitted a website search tool was "exploited", allowing a clone website to be viewed. It said three IP addresses made approximately 2000 searches over a 48-hour period.

According to National's version of events, it searched for 21 hours, from 5pm on Monday until 2pm on Tuesday, not 48 hours.

5:18am - At the request of Makhlouf, the SSC launched an inquiry into "unauthorised access to Budget material".

8:45am - Simon Bridges addressed media, confirming Treasury's search tool was used to uncover Budget information.

10:30am - Budget lock-up began. The Budget documents showed the National Party's information to be largely accurate, although incomplete.

2pm - Budget released publicly.  

Investigation launched into Treasury Secretary

June 4 - The SSC launched an investigation into Makhlouf and his actions and public statements about the cause of the information breach. This was in addition to the inquiry into the access to Budget information.

June 27 - Makhlouf due to leave his role of Treasury Secretary and take up a role as Governor of the Irish Central Bank.