Her Majesty's Revenue and Customs (HMRC) in the U.K. has been hit with 521,582 malicious email attacks over the last three months, according to official figures. The HRMC oversees tax affairs for millions of people in the U.K.

The data, which was obtained by the Parliament Street think tank cyber security research team using the Freedom of Information (FOI) Act, showed an average of over 5,000 spam, phishing and malware attacks. These attacks were recorded by HRMC over the a three month period between June and September, 2020.

Spam and junk made up the largest proportion of attacks - contributing to 377,820 of the total 521,582 recorded by HMRC. Whereas, phishing, made up 128,255 of the overall number of attacks, and the remaining 15,507 attacks were said to contain malware.

The data also revealed that there has been a steady increase in monthly attacks aimed at HMRC, since June 13^th during the COVID-19 lockdown period. Figures rose from 115,585 in June, to 153,992 in July, and 175,227 attacks in August.

Figures for September showed 76,778 attacks in the first 10 days alone, leading Parliament Street researchers to reasonably assume that this quantity could have tripled to a staggering 230,000 malicious email attacks in total by the month end.

The types of attack were broken down into three main categories: malware/antivirus, phishing and spam/junk.

“Organizations like HMRC, which oversee the tax affairs of millions of people, are a top target for malicious hackers who will stop at nothing to steal confidential data. These figures illustrate the huge volume of malicious phishing emails targeted at HMRC employees on a daily basis and serve as a reminder to other government organizations to keep email security and cyber awareness front of mind in an increasingly dangerous online world," said Cyber expert Chris Ross, SVP International, Barracuda Networks. "All it takes is a single rogue email to reach the inbox of an unsuspecting staffer undetected and criminals could easily get hold of critical personal data, passwords or log-in credentials. Such a scenario could cause serious problems, both in terms of data protection and disruption to critical public services."