Scammers stole £47m from the online accounts of 100,000 people after posing as taxpayers, HMRC has revealed.
The tax authority said it is writing to those affected to confirm it has secured their accounts, they haven't lost any money, and they don't need to do anything.
"These are attempts to claim money fraudulently from HMRC, not from customers," HMRC said.
There has already been a criminal investigation with arrests made last year, HMRC confirmed.
It said the scammers used phishing attacks to gain customer details and attempted to claim rebates.
Phishing is when criminals use personal information gathered externally to imitate a person and access services.
The tax authority said this was not a cyber or hacking attack, the likes of which have affected major retailers in recent weeks.
Angela MacDonald, HMRC's deputy chief executive, told MPs at an Treasury Select Committee on Wednesday that a "lot of money" was taken and "it's very unacceptable".
HMRC's permanent secretary and chief executive John-Paul Marks told the committee "a lot of work [was] then done to intercept this incident. We identified and locked down the compromised accounts."
HMRC's representatives were reprimanded by MPs for not writing to the committee about the fraud at the time.
Treasury Select Committee Chair Dame Meg Hillier said the committee had only heard about the scam when it was reported in the news.
"A word to the wise... let me use my position as chair just to remind you, gently – well perhaps not so gently – that it would be normal to advise parliament of things if you're appearing in front of a committee. Not to have it announced during the committee hearing," she added.
"Money was got. By criminals. By penetrating the digital system. A lot of people would consider that a cyber crime, however you define it", she said.