HMRC workers admit £47m loss after phishing scam breaches 100,000 taxpayer accounts

HMRC has been hit by a costly phishing scam, with £47 million lost after tens of thousands of tax accounts were compromised, MPs have been told.

Top civil servants at HM Revenue and Customs (HMRC) briefed the Treasury Committee that around 100,000 individuals are being notified following an "organised crime" incident that initiated last year, resulting in their accounts being locked.

John-Paul Marks, the chief executive of HMRC, assured taxpayers affected by the breach that they would face "no financial loss". In his address to the Committee, Mr Marks said: "It's about 0.2 per cent of the PAYE population, around 100,000 people, who we have written to, are writing to, to notify them that we detected activity on their PAYE account."

When asked whether this pertained solely to individual workers' PAYE accounts rather than companies, he confirmed: "That's right, individuals. To be clear, no financial loss to those individuals."

Mr Marks further explained: "This was organised crime phishing for identity data outwith of HMRC systems, so stuff that banks and others will also unfortunately experience, and then trying to use that data to create PAYE accounts to pay themselves a repayment and/or access an existing account."

He shared with the MPs that an investigation into the scam, which spanned international borders and took place last year, resulted in "some arrests last year."

Angela MacDonald, HMRC's Deputy Chief Executive and Second Permanent Secretary, told the committee: "At the moment, they've managed to extract repayments to the tune of £47 million. Now that is a lot of money, and it's very unacceptable.

"We have overall, in the last tax year, we actually protected £1.9 billion worth of money which sought to be taken from us by attacks."

Ms MacDonald emphasised that the breach was "not a cyber attack, we have not been hacked, we have not had data extracted from us".

She further clarified: "The ability for somebody to breach your systems and to extract data, to hold you to ransomware and all of those things, that is a cyber attack. That is not what has happened here."

HMRC confirmed it had secured affected accounts and erased log-in details to thwart future unauthorised access. Any incorrect information has been expunged from tax records and officials have verified no other details have been altered.

Affected individuals will receive a letter from HMRC within the next three weeks.

Mr Marks also informed MPs that HMRC phone lines were down on Wednesday afternoon, but assured this was "coincidental".

They will be "back up and available in the morning", he added.

An HMRC spokesperson stated: "We've acted to protect customers after identifying attempts to access a very small minority of tax accounts, and we're working with other law enforcement agencies both in the UK and overseas to bring those responsible to justice.

"This was not a cyber-attack – it involved criminals using personal information from phishing activity or data obtained elsewhere to try to claim money from HMRC.

"We're writing to those customers affected to reassure them we've secured their accounts and that they haven't lost any money."