HMRC Thwarts Organised Crime's Phishing Scheme Targeting Taxpayers

The UK's HMRC detected unauthorized access to 100,000 taxpayer accounts in 2024, attributed to organized crime's phishing attempt. Affected accounts were secured, and erroneous data was removed. The agency assured no financial loss occurred, with an investigation leading to arrests. The incident was not classified as a cyberattack.

The UK tax authority, HMRC, revealed on Wednesday that its security measures identified unauthorized activities on about 100,000 online taxpayer accounts. This breach, occurring in 2024, was due to an organized crime group's phishing attempt, as detailed in a notice on the government's website.

HMRC clarified that the breach aimed to extract funds from the tax authority, not directly from individuals' accounts. The tax office has since secured affected accounts, notifying customers, altering login credentials, and removing false entries from tax records.

John-Paul Marks, HMRC's chief executive, informed lawmakers of last year's criminal investigation leading to multiple arrests. Marks emphasized the breach involved identity data targeted outside HMRC systems, with efforts underway in collaboration with both domestic and international law enforcement.

(With inputs from agencies.)