A think tank has attributed the "surging" number of malicious emails targeted at HM Revenue & Customs to widespread remote working making the taxman an increasingly desirable target for hackers.
The warning comes as it emerged HMRC had received 521,582 malicious email attempts over a three-month period this summer, with severity varying from malware attacks, phishing attempts and spam messages.
A Freedom of Information request submitted by think tank Parliament Street revealed the taxman had received an average of 5,000 of these emails a day, and the number has been increasing each month.
Figures rose from 115,585 in June, to 153,992 in July and 175,227 in August. In the first ten days of September alone HMRC recorded 76,778 suspicious emails.
The upward trajectory has been attributed by the think tank to the ongoing coronavirus crisis, a pattern which has also been detected in the wider population amid warnings of scammers attempting to benefit from the uncertainty of the pandemic and an increasing number of people working from home.
The data showed 128,255 of the attacks were phishing attempts and 15,507 emails contained malware.
Chris Ross, senior vice president international at IT security company Barracuda Networks, said its access to the tax affairs of millions of people made HMRC a "top target for malicious hackers" looking to steal confidential data.
Mr Ross added: "These figures illustrate the huge volume of malicious phishing emails targeted at HMRC employees on a daily basis and serve as a reminder to other government organisations to keep email security and cyber awareness front of mind in an increasingly dangerous online world.
"All it takes is a single rogue email to reach the inbox of an unsuspecting staffer undetected and criminals could easily get hold of critical personal data, passwords or log-in credentials.
"Such a scenario could cause serious problems, both in terms of data protection and disruption to critical public services."
Andy Heather, vice president at software company Centrify, warned hackers considered HMRC a "goldmine" of personal and company data.
Mr Heather said: "So it’s no surprise that they are bombarding the organisation with an array of phishing, malware and spam attacks on a daily basis.
"With the Covid-19 crisis forcing millions of people to work from home, there is an increased risk that malicious parties using stolen log-in details can operate without workers spotting what’s happening."
There was no data to suggest any of the emails had been successful in damaging HMRC systems or accessing its data.
An HMRC spokesperson said: "HMRC has one of the largest and most complex IT estates in the UK, enabling us to serve 50 million customers and support 65,000 colleagues.
"Like all large organisations, we protect our systems from high volumes of malicious emails.
"We have robust systems in place to protect our IT infrastructure and the tax system and have dedicated cyber security command centres which allow us to monitor, manage, and respond to cyber security risks around the clock."
rachel.mortimer@ft.com
What do you think about the issues raised by this story? Email us on fa.letters@ft.com to let us know.
