Following the recent announcement by HMRC of a £47m loss in a phishing attack, ACCA has now had an initial meeting with HMRC.

While understanding that cybercrime and the obtaining of confidential information can affect all organisations and individuals, on behalf of our members and taxpayers ACCA expressed frustration that HMRC has not been transparent or timely in its communication over this important issue.

While ACCA has had continued engagement with HMRC over different topics over the last few months, we had not been made aware of this serious breach until we read the HMRC statement on 4 June. We are disappointed by HMRC’s actions in relation to this incident.

From our discussion with HMRC we understand:

• The attack involved personal accounts, not company or agent accounts.
• The vast majority of the 100,000 accounts impacted were unrepresented taxpayers; we understand some will have agents.
• We understand personal and bank information has been obtained in these attacks
• As has been reported, those impacted will receive letters from now until 25 June.
• We understand that agents will not receive notification if clients have been impacted. While HMRC says no one will suffer personal tax loss, HMRC might wish to consider compensation for those affected – including any adviser time and other costs.
• HMRC has is setting up a separate helpline for those impacted.

We continue to request information from HMRC. If members have questions, please do email us at ukpolicy@accaglobal.com.

This incident will have a negative impact on HMRC’s attempts to be a trusted tax authority. Our members have consistently fed back about the serious impacts of the erosion of customer service and timely replies from HMRC; this will put further pressure on those relationships. Hard work is required in terms of investing in systems, people, training and services to restore UK taxpayers’ faith in HMRC.