On 4 June 2025, HMRC announced that it had detected unauthorised access to the online accounts of some individuals.  

HMRC said that it had protected the affected accounts by deleting the log-in credentials (government gateway user ID and passwords). It has also removed any incorrect information from the individuals’ tax records and checked that no other details were changed. HMRC said that this had been an attempt to take money from HMRC, not from the individuals.  

HMRC is now in the process of writing to the affected individuals to inform them of this. The letter explains how the person can access their HMRC account and how to contact HMRC on a dedicated helpline and email address if the person has any concerns. HMRC expects that all letters will be sent by 25 June 2025. Only individuals with affected accounts will be contacted. Those concerned whether the letter is genuine can check here. 

Later on 4 June 2025, HMRC provided further information in evidence to the Treasury Select Committee. HMRC said that the attack used information obtained from non-HMRC sources through phishing attacks on individuals and was not a cyber breach of HMRC systems. The attack has affected around 100,000 individuals, mostly in pay as you earn, and had cost HMRC approximately £47m in the form of fraudulent repayments. In many of the cases, the taxpayer did not have an active digital tax account and the criminals set up new credentials.  

HMRC said that work on this issue had been ongoing for some time, with some arrests made in 2024. HMRC is writing to the affected individuals now that it has concluded its analysis of the accounts. In its evidence to MPs, HMRC said that it has protected £1.9bn from criminal attacks in the last tax year.  

Further information 

• HMRC phishing and scams: detailed information - GOV.UK