The State Services Commission report was ordered in the fallout of Mr Makhlouf claiming Treasury's website had been "deliberately and systematically hacked" and referring the matter to police.
Police quickly concluded nothing illegal had happened and soon after it was revealed the National Party had uncovered sensitive Budget information by using the website's search bar.
The Commission's report - released today - said Mr Makhlouf did not act reasonably in his use of the word "hacked" or his subsequent explanations to media.
That included the use of a "bolt analogy" in an interview with RNZ's Morning Report.
State Services Commissioner Peter Hughes said Mr Makhlouf should have publicly taken responsibility for the failure rather than focusing on the searchers of the website.
"The breach of security around the Budget documents should never have happened, under any circumstances," Mr Hughes said.
"The right thing to do here was to take personal responsibility for the failure irrespective of the actions of others and to do so publicly. He did not do that."
State Services Commissioner Peter HughesState Services Commissioner Peter Hughes Photo: RNZ / Dom Thomas
The investigation found Mr Makhlouf acted in good faith and without political bias when he notified the Finance Minister and police.
But Mr Hughes said, regardless, Mr Makhlouf's actions fell well short of his expectations.
The Treasury secretary should have sought more advice before issuing a media statement about the referral, he said.
"In my view, it was not managed well by Mr Makhlouf," Mr Hughes said. "It was a clumsy response to a serious issue and is not what I expect of an experienced chief executive."
A separate inquiry is investigating how the breach took place and the adequacy of Treasury's information security.
Mr Makhlouf is finishing up at Treasury to take up the role of governor of the Central Bank of Ireland.
His replacement was this week announced as Dr Caralee McLiesh, a former deputy secretary of the New South Wales Treasury.
