Her Majesty’s Revenue and Customs (HMRC) has been bombarded with 521,582 malicious email attacks over the last three months, according to official figures.
The 521,582 total email attacks are made up of phishing, malware and spam attacks, and the surging quantity is likely an effect of Covid-19 – with remote working making HMRC an even more desirable target for hackers than before.
The data, which was obtained by the Parliament Street think tank cyber security research team using the Freedom of Information (FOI) Act, showed an average of over 5,000 spam, phishing, and malware attacks were recorded by the organisation over the a three month period between June and September.
Spam and junk made up the largest proportion of attacks – contributing to 377,820 of the total 521,582 recorded by HMRC. Whereas, phishing, made up 128,255 of the overall number of attacks, and the remaining 15,507 attacks were said to contain malware.
The data also revealed that there has been a steady increase in monthly attacks aimed at HMRC, since June 13th during the Covid-19 lockdown period. Figures rose from 115,585 in June, to 153,992 in July, and 175,227 attacks in August.
Figures for September showed 76,778 attacks in the first 10 days alone, leading ParlStreet researchers to reasonably assume that this quantity could have tripled to a staggering 230,000 malicious email attacks in total by the month end.
The types of attack were broken down into three main categories: malware/antivirus, phishing and spam/junk.
Cyber expert Chris Ross, SVP International, Barracuda Networks comments:
“Organisations like HMRC, which oversee the tax affairs of millions of people, are a top target for malicious hackers who will stop at nothing to steal confidential data. These figures illustrate the huge volume of malicious phishing emails targeted at HMRC employees on a daily basis and serve as a reminder to other government organisations to keep email security and cyber awareness front of mind in an increasingly dangerous online world.
“All it takes is a single rogue email to reach the inbox of an unsuspecting staffer undetected and criminals could easily get hold of critical personal data, passwords or log-in credentials. Such a scenario could cause serious problems, both in terms of data protection and disruption to critical public services.
Key to preventing this is ensuring robust email security systems are in place to identify and quarantine suspicious communications before they reach workers, alongside rigorous training to ensure all employees are aware of the risks posed by increasingly sophisticated phishing attempts.”
Security specialist Andy Heather, VP, Centrify comments:
“Hackers see HMRC as a goldmine of personal and company data, so it’s no surprise that they are bombarding the organisation with an array of phishing, malware and spam attacks on a daily basis. If successful, one of these attempts could lead to cyber criminals gaining access to critical data such as user credentials and passwords, allowing the hacker to move around the organisation undetected, without raising suspicion from administrators. This in turn allows them to target privileged accounts for the purpose of data theft, server disruption or even ransom attacks.
“With the Covid-19 crisis forcing millions of people to work from home, there is an increased risk that malicious parties using stolen log-in details can operate without workers spotting what’s happening. It is therefore critical that organisations like HMRC have the necessary systems in place to verify that users are who they say they are, preventing third parties with stolen data from gaining access to critical information.”
