Organized crime has extracted £47 million from the UK government in a phishing operation. The operation involved mimicking taxpayer credentials and claiming payments from HMRC. No data from taxpayers was taken, but the incident has affected 100,000 Pay-As-You-Earn (PAYE) accounts. Authorities have begun a criminal investigation, and arrests have been made. The £47 million was taken through three separate payments, and HMRC was able to protect £1.9 million that was sought by the entities behind the operation.

TfL Data Breach: Couple Jailed for £650k Tax Fraud After Stealing Employee Data A husband and wife have been sentenced to three years and nine months in prison for orchestrating one of the most severe data breaches in Transport for London (TfL) history, resulting in a £433,000 loss to the UK’s public funds. Luciana Akanbi, 38, an HR employee at TfL, exploited her access to sensitive employee records, stealing personal data including passport numbers, National Insurance details, and bank information from 107 colleagues. Between September 2021 and January 2022, she and her husband, Femi Akanbi, 51, used the stolen data to file 139 fraudulent tax rebate claims with HMRC, totaling nearly £650,000. Only £433,000 was successfully siphoned before authorities intervened. The fraud, described by Woolwich Crown Court Judge David Miller as TfL’s "worst ever" data breach, forced the organization to overhaul its security systems. The breach also eroded staff morale, as affected employees faced credit checks, financial disruptions, and additional scrutiny from HMRC. Prosecutors revealed the scheme was highly sophisticated, involving 38 devices and a complex money-laundering operation to conceal the stolen funds. Luciana Akanbi, who had worked at TfL since 2017, initially attempted to shift blame to her husband’s IT-specialist cousin during HMRC’s investigation. However, evidence confirmed her role as the primary source of the stolen data, while Femi Akanbi acted as the key facilitator, channeling the information into fraudulent claims. Financial strain, exacerbated by Femi’s gambling addiction with over £50,000 lost to betting accounts was cited as a motive. Both Nigerian nationals, the Akanbis were ordered to serve identical sentences. Judge Miller noted their financial gains extended beyond the £82,000 traced to their accounts, though he acknowledged the stolen money was "gone" and no restitution would be ordered. Their potential deportation remains under consideration. TfL’s Head of Counter-Fraud & Corruption, Richard Mullings, confirmed the organization has since implemented stricter controls on employee data access. The case was prosecuted in collaboration with HMRC, which emphasized its commitment to pursuing tax fraud. The breach underscores the far-reaching consequences of insider threats, from financial losses to long-term reputational damage for affected organizations.