A committee of MPs has criticised HM Revenue and Customs (HMRC) for failing to promptly report a data breach affecting approximately 100,000 taxpayers.
The Treasury Committee said it only learned of the incident through a notification published on the HMRC website, coinciding with a live session on June 4.
The breach, a phishing scam, resulted in the loss of £47 million, a figure recently revised to £49 million.
HMRC officials informed the Treasury Committee that they have contacted, or are in the process of contacting, 100,000 individuals whose accounts were locked down following what they described as an “organised crime” incident that began last year.
Adding to the controversy, the Association of Chartered Certified Accountants (ACCA) stated in a letter published by the committee on Tuesday that it had not discussed the phishing incident with HMRC and was unaware of it before the June 4 hearing.
The committee also published a letter sent via email from its chairwoman Dame Meg Hillier to John-Paul Marks, chief executive, HMRC.
The letter said: “I am alarmed that it was never deemed necessary to inform Parliament about an issue which affected such a vast number of taxpayers and led to the loss of £47 million of public money.
“To discover this information during a session from press reports and without adequate time for the committee to review the information in detail is unacceptable.”
The letter said the committee is seeking responses from HMRC as to “why was Parliament not notified earlier about the loss of £47 million of taxpayers’ money, whether through a written ministerial statement and/or public or confidential letters to the Treasury Committee and the Public Accounts Committee?”
The committee is also seeking responses on why the update was published on the day of the committee hearing on the work of HMRC and who else in Government was told about the incident and when.
It also wants to receive a timeline of how the incident unfolded and find out what measures HMRC has put in place to ensure that such incidents do not happen in future.
The letter asked for a reply by June 24, 2025.
Meanwhile, the letter from Glenn Collins, head of technical and strategic engagement, ACCA, to Dame Meg, dated June 5, said: “While we regularly engage with HMRC, including earlier in the year about issues relating to agent account access, we have not received any communication from HMRC on the issue of taxpayer account breaches until yesterday.
“We have highlighted to HMRC our frustration that HMRC has not been transparent or timely in its communication over this important issue.”
