HMRC falls prey to phishing which it deems not a Cyber Attack

A cyber-attack typically involves hackers breaching a computer network to install malicious software or steal sensitive data. In a recent case involving HM Revenue and Customs (HMRC)—the UK’s tax authority responsible for collecting taxes and distributing public funds to support essential services and vulnerable populations—a cybersecurity incident raised alarms, though the nature of the breach has since been clarified.

HMRC has officially denied that it was directly compromised by a cyber-attack. Instead, officials confirmed that attackers gained access to the Treasury Committee’s computer systems by exploiting login credentials obtained through a phishing campaign unrelated to HMRC’s own infrastructure. The incident affected approximately 100,000 individuals—roughly 0.2% of the UK’s taxpayer population.

Crucially, HMRC emphasized that no financial data was compromised. According to preliminary investigations, the attackers used a technique known as “credential stuffing,” where stolen usernames and passwords from external sources are reused in attempts to access other systems. In this case, the attackers hoped to leverage previously acquired login data to infiltrate HMRC systems, but were unsuccessful in extracting any sensitive financial records.

So far, there is no evidence that the stolen information has been leaked or sold on the dark web. HMRC’s IT department responded swiftly by resetting all relevant network access credentials over the weekend to secure the system against further attempts.

Those impacted by the breach have been, or will be, individually notified about the potential risks of cybercrime and how to respond. HMRC also confirmed that all affected individuals will receive an official letter in the post, outlining the details and safeguards in place.

In the aftermath of the breach, one HMRC user reported that the organization’s phone lines were temporarily taken offline as a precautionary measure. Further details are expected as investigations continue.