HMRC Locks Down 100,000 Personal Tax Accounts

9th June 2025

HMRC Locks Down 100,000 Personal Tax Accounts After Organised Crime Breach

HMRC has locked down up to 100,000 online personal tax accounts after discovering unauthorised access linked to a sophisticated scam by organised crime groups. The breach, which resulted in £47 million being fraudulently claimed from HMRC—not from individual taxpayers—was first identified nearly a year ago but only recently disclosed to the public.

HMRC advises this was not a cyberattack on its systems, but rather a prolonged campaign of phishing and fraudulent activity aimed at exploiting the tax authority. Affected accounts, representing around 0.2% of PAYE taxpayers, have been locked, and login credentials deleted as a precaution.

Taxpayers impacted by the breach will receive letters between 4 and 25 June 2025. These letters will contain instructions on how to regain access by setting up a new Government Gateway user ID and password. Until then, no action is required unless you are directly contacted by HMRC.

The attack exploited weaknesses through a series of phishing attempts designed to trick users into revealing login details, which were then used to submit false claims. While no businesses were impacted, this represents one of the most significant breaches of taxpayer data in recent years.

Given the relatively small number of accounts involved, it is unlikely you will have been affected by this, however, the incident serves as a reminder of the ever-present threats to digital systems. While no personal funds were targeted, HMRC encourages taxpayers to remain vigilant and regularly check their online tax accounts for any suspicious activity.