Treasury secretary and chief executive Gabriel Makhlouf says there have been "multiple and persistent" attempts to access Treasury information.
On Tuesday, National leader Simon Bridges revealed details of the Wellbeing Budget - two days before the official announcement.
- Budget leak: Simon Bridges accuses Grant Robertson of smear job
- Grant Robertson admits some Budget details National released are correct
- National's Budget 2019 drops could be the Government's greatest crisis
But Treasury says there's sufficient evidence to show its systems had been deliberately and systematically hacked, and had referred the issue to the police on advice from the National Cyber Security Centre.
"Yesterday afternoon, we discovered multiple and persistent attempts to gain unauthorised access to Budget information," Makhlouf told The AM Show on Wednesday.
He said there had been at least 2000 attempts.
Makhlouf also said that parts of the information had been in the process of being uploaded, but that information wasn't publicly available.
"I have instigated a review to check exactly what has happened. But the information I had yesterday confirmed there was no accidental release of the information.
"There is a lot of information that is uploaded and it takes time to upload. So there was a process, but it wasn't open to the public."
He couldn't tell if the hack had come from overseas or from within New Zealand.
Makhlouf said he had no evidence the whole Budget had been extracted from the Treasury's systems.
"We don't believe anything else of material nature is out there, but we can't be 100 percent certain.
"We are pretty confident that we know what it was that was attacked and what information was accessed, but what I can't do today is tell you I am 100 percent certain, I am over 90 percent certain that we know and we have closed it down."
Finance Minister Grant Robertson said on Tuesday it's an "extremely serious" matter and is calling on the National Party not to leak any more information.
"We have contacted the National Party tonight to request that they do not release any further material, given that the Treasury said they have sufficient evidence that indicates the material is a result of a systematic hack and is now subject to a Police investigation."
Bridges then fired back on Twitter, saying Robertson had "falsely smeared" the National Party "to cover up his and The Treasury's incompetence".
"When what has occured is revealed, he will need to resign."
Newshub.
