The HMRC has lost £47m as a result of the attack, HMRC officials told MPs at Treasury Committee, with 0.2% of PAYE taxpayers with personal tax accounts affected, representing around 100,000 individuals, but businesses are not affected.

The breach was identified by HMRC’s IT team and was an attempt to claim money from the tax authority, rather than individual taxpayers, HMRC said, and criminal investigations are under way.

But HMRC officials told the Treasury Committee that this was 'not a cyber attack' but was an attack by several organised crime gangs and happened over an extended period of time last year, with numerous phishing attacks 'designed to extract money' from the tax authority. 

But the HMRC has only just written to affected taxpayers after discovering the issue last year, and launching a criminal investigation. 

At the same time, the telephony interface has been hit by a system outage today that affects all phone lines so it is not possible to contact HMRC by phone at all, except on a specific phone number for people affected by the phishing attack letters.

Anyone phoning HMRC today is met with a message that 'this phone line is temporarily unavailable due to technical difficulties but normal service will resume as soon as possible'.

Angela MacDonald, deputy CEO of HMRC told the Treasury Committee 'the system will be up and running by tomorrow morning'.

But this was ‘not a cyber security breach’, HMRC stressed, adding it ‘this was not an attack on HMRC’s systems, HMRC is always facing these kinds of attempts on the organisation, it is a constant battle’.

It is not clear how many taxpayers have been affected, but they will be individuals with ‘Personal Tax Accounts’. 

Later today the Treasury Committee has a hearing with the newly appointed HMRC chief executive John-Paul (JP) Marks where MPs might address the issue.

In a statement online, HMRC said the affected accounts have been ‘locked down’, and Government Gateway user ID and passwords have been deleted to prevent any access to the individual accounts.

Taxpayers will receive a letter within the next three weeks informing them about the breach and telling them that they do not need to take any action themselves.

In a warning online, HMRC said: ‘This was an attempt to claim money from HMRC, not an attempt to take any money from you.’

HMRC is in the process of informing affected taxpayers about the breach, stating: ‘We have written to affected customers and taken action to protect these accounts.’

HMRC confirmed that it took immediate action to address the breach by:

• locking down affected accounts;
• deleting log in credentials (Government Gateway user ID and passwords) to prevent future unauthorised access;
• removing any incorrect information from tax records; and
• checking no other details were changed.

Letter from HMRC

HMRC will be sending letters to all affected taxpayers, going out from today, 4 June through to 25 June 2025.

Affected taxpayers will need to take action to regain access to HMRC online accounts and will have to set up an account and new Government Gateway user ID and password.

If you do not receive a letter you are unlikely to have been affected, but HMRC suggests taxpayers should check their personal tax accounts to make sure they still have access.

If you’re using the HMRC App, go to managing your sign in details and then sign in using your Government Gateway user ID and password.

If you have any concerns, email the HMRC fraud team at [email protected]

Back in March 2022, HMRC warned that criminals were ‘attempting to obtain customers’ Government Gateway logins and other personal details, enabling them to register for income tax self assessment and submit bogus tax refund claims before pocketing the repayment’.

All HMRC phonelines down in major outage | 4 Jun 2025

HMRC guidance, Unauthorised access of HMRC online accounts [Issued 4 June 2025]