Organized criminals stole £47 million (around $64 million) from the UK’s tax authority in 2024 through a large-scale phishing scam that compromised over 100,000 taxpayer accounts, according to His Majesty’s Revenue and Customs (HMRC).
HMRC disclosed the breach in a notice on the government website, emphasizing that no taxpayers suffered financial losses. The fraud involved criminals posing as legitimate customers to file false payment claims. They succeeded in making three significant fraudulent claims totaling the full amount.
“This is a substantial and completely unacceptable loss,” said HMRC Deputy CEO Angela MacDonald during a parliamentary hearing. HMRC’s chief executive, John-Paul Marks, confirmed a criminal investigation had been launched, resulting in several arrests.
The scam, described as identity theft via phishing, exploited data obtained outside HMRC’s systems. Authorities believe this was not a direct cyberattack but a case of stolen personal information being misused.
HMRC has since written to affected individuals, deactivated compromised accounts, erased false information, and reassured taxpayers that no action is required on their part. “This was a fraud targeting HMRC—not an attempt to steal from you,” the agency noted.
The breach highlights the growing sophistication of phishing attacks targeting government systems using stolen identity data.