HMRC has revealed that over 10,000 customers were potentially affected by serious data breaches overseen by the body over the last year.

According to its Annual Report & Accounts 2021-22, the group reported a total of 22 personal data-related incidents to the Information Commissioner’s Office (ICO) in the last 12 months. This represents an increase from the 18 reported in 2020-21.

Of these, three incidents involved personal information used to make changes to customer records on HMRC systems without authorisation. Another two were down to the loss of inadequately protected electronic equipment, devices or paper documents from secured government premises.

The majority, 16 breaches, were described as being due to unauthorised disclosure, with a final two begin attributed to ‘other’ causes.

However, in the previous period, 18,298 people were potentially affected, meaning that the number of victims affected 2021-22 decreased to 10,896.

Five additional data incidents occurred over the past year which were handled internally, potentially impacting a further 911 customers.

According to HMRC, it has made several changes in order to strengthen the identification and reporting of personal data breaches. These include delivering a Cyber Tactical Remediation Programme, moving significant number of services out of legacy data centres, and implementing a new Security Incident Response Tool.

As part of their aim of “reaching a tolerable position by March 2025,” HMRC stated that it was in the process of implementing a three-year Enterprise Security Programme, alongside their Securing our Technical Future Programme.

These efforts aim to build upon their switch of key platforms to cloud-based infrastructure and strengthening their data analyst team, having previously splashed £12 million on data staff over the past five years.

“We are still in the process of delivering our planned mitigations, focussing on moving away from legacy technologies and embracing newer and more secure systems,” the HMRC report said.

“Cybersecurity remains a challenging area due to the rapidly evolving cyber-threat landscape, and until improvements are fully implemented, this risk will remain significant.”

Recommended

• Comment | What is the future of data management?
• Reactec wearable device looking to stamp out workplace injuries
• UserTesting CEO to talk empathetic leadership with Startup Grind Scotland

Cybersecurity expert Achi Lewis, Area VP EMEA for Absolute Software, commented: “Due to the volume of staff that large organisations like HMRC employ, it is inevitable that data incidents are going to occur. What’s crucial is that these organisations mitigate the volume of breaches as protecting customer data is vital.

“Staff training programmes are one aspect of the solution, and HMRC should be commended for taking this seriously. Arming staff with the knowledge of potential threats and the consequences of breaches can help them stay vigilant, and prevent potential losses before they occur, as well as being able to improve their reporting of these incidents.

“Solutions such as Zero-Trust Network Access can help to evaluate all users and their devices each time they connect to a network or application, only granting access if they are trusted. Should a malicious actor breach an application, they will be shut off from the rest of the network. Secure access controls, on top of this, can give IT teams the power to freeze or shut off compromised devices to prevent further breaches from occurring across a network,” he added.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.