Her Majesty's Revenue and Customs (HMRC), the British central tax office, has been bombarded with 521,582 malicious email attacks over the last three months, according to official figures released today.
The data, which was obtained by the Parliament Street think tank cyber security research team using the Freedom of Information (FOI) Act, showed an average of over 5,000 spam, phishing, and malware attacks were recorded by the organisation over the a three month period between June and September.
Spam and junk made up the largest proportion of attacks - contributing to 377,820 of the total 521,582 recorded by HMRC. Whereas, phishing, made up 128,255 of the overall number of attacks, and the remaining 15,507 attacks were said to contain malware.
All it takes is a single rogue email to reach the inbox of an unsuspecting staffer undetected and criminals could easily get hold of critical personal data, passwords or log-in credentials."
The data also revealed that there has been a steady increase in monthly attacks aimed at HMRC, since 13 June during the covid-19 lockdown period. Figures rose from 115,585 in June, to 153,992 in July, and 175,227 attacks in August.
Figures for September showed 76,778 attacks in the first 10 days alone, leading ParlStreet researchers to reasonably assume that this quantity could have tripled to a staggering 230,000 malicious email attacks in total by the month end.
The types of attack were broken down into three main categories: malware/antivirus, phishing and spam/junk.
Cyber expert Chris Ross, SVP International, Barracuda Networks commented: "Organisations like HMRC, which oversee the tax affairs of millions of people, are a top target for malicious hackers who will stop at nothing to steal confidential data. These figures illustrate the huge volume of malicious phishing emails targeted at HMRC employees on a daily basis and serve as a reminder to other government organisations to keep email security and cyber awareness front of mind in an increasingly dangerous online world."
Ross added, "All it takes is a single rogue email to reach the inbox of an unsuspecting staffer undetected and criminals could easily get hold of critical personal data, passwords or log-in credentials. Such a scenario could cause serious problems, both in terms of data protection and disruption to critical public services."
"Key to preventing this is ensuring robust email security systems are in place to identify and quarantine suspicious communications before they reach workers, alongside rigorous training to ensure all employees are aware of the risks posed by increasingly sophisticated phishing attempts," he said.