UK Treasury Committee Rebukes HMRC Over £47m Phishing Breach Affecting 100,000 Taxpayers

The UK Treasury Committee has strongly criticized HM Revenue and Customs (HMRC) for failing to promptly inform Parliament about a large-scale phishing attack that compromised the data of around 100,000 taxpayers and resulted in a loss of approximately £49 million. MPs only learned of the breach during a committee hearing, after details were published on the HMRC website on the same day, rather than through direct communication from HMRC. Dame Meg Hillier, chair of the Treasury Committee, expressed alarm over the lack of transparency and accountability, stressing that Parliament should have been notified much earlier. The committee has formally requested detailed explanations from HMRC’s CEO John-Paul Marks regarding the delay in notification, the extent of the financial loss, the identification of all affected accounts, and the impact on HMRC’s Making Tax Digital program. The Association of Chartered Certified Accountants confirmed they were unaware of the phishing incident before the hearing, highlighting the communication failures. Overall, the incident has raised serious concerns about HMRC’s handling of cybersecurity breaches and its obligations to taxpayers and Parliament.