"Ministry of Interior said its security team discovered that a VPN account assigned to the Ministry of Health was used to query the RENAPER database for 19 photos “in the exact moment in which they were published on the social network Twitter.”"

My guess is that this was slightly afterwards - I know if I had access to the db and saw some information being posted on twitter, I might want to cross-check (well that make more sense, than the poster looking up these people and doxing them instantaneously)