Committee publication · Correspondence · 10 June 2025
Correspondence from the Chair to HM Revenue and Customs regarding 'Phishing' attacks, dated 10 June 2025
From: Treasury Committee
Inquiry: Work of HM Revenue and Customs
Summary
The Treasury Committee Chair writes to HMRC's Chief Executive following oral evidence on 4 June 2025, expressing alarm that phishing attacks affecting 100,000 taxpayers and resulting in £47 million in losses were not disclosed to Parliament earlier. The letter demands clarification on whether this was accidental oversight or deliberate, and poses 12 detailed questions about the incident's timeline, governance notification, data breaches, and preventative measures.
Key findings
- HMRC experienced phishing attacks over the past year affecting approximately 100,000 taxpayers with confirmed losses of £47 million, disclosed only during oral evidence rather than through formal Parliamentary notification.
- HMRC published only a short GOV.UK page on 4 June 2025 (the day of the hearing) without a press release, raising questions about transparency and timing of disclosure.
- Chair questions whether the failure to notify Parliament of significant losses violates Managing Public Money disclosure requirements for fraud losses.
- ACCA reports that two-thirds of surveyed members experienced negative impacts on productivity from HMRC service levels, and states ACCA was not engaged by HMRC regarding the phishing incident prior to the hearing.
- Concurrent HMRC phoneline outages occurred during the hearing, unrelated to phishing but raising questions about systemic resilience and frequency of such incidents.
Tone
CriticalTopics
Key actors
Dame Meg Hillier MP, John-Paul Marks, Angela MacDonald, HMRC, ACCA, Treasury Committee, Public Accounts Committee
Notable line
“I am alarmed that it was never deemed necessary to inform Parliament about an issue which affected such a vast number of taxpayers and led to the loss of £47 million of public money.”
Key Quotes
“I am alarmed that it was never deemed necessary to inform Parliament about an issue which affected such a vast number of taxpayers and led to the loss of £47 million of public money.”
“To discover this information during a session from press reports and without adequate time for the Committee to review the information in detail is unacceptable.”
“I seek your reassurance that this was an accidental oversight rather than a deliberate action.”
Source · parliament.uk record ↗