Hackers have targeted 50,000 people a day in the UK as part of a major tax refund scam.
Posing as government officials, the emails duped victims into sharing their personal details by telling them they could reclaim money.
The enterprise, which had been mimicking the government's "@gov.uk" domain name, took six weeks to shut down.
Details of the scam have to light amid growing concern the UK's cyber defences.
Chancellor Philip Hammond has insisted the UK will be able to "strike back" against future high-level hacks, as he introduced a new strategy that aims to improve the countries cyber security,
Announcing £1.9 billion in funding for the scheme, Mr Hammond underlined the security threat posed by hackers harnessing personal devices for malicious purposes, a strategy used during the major cyber attack that brought down Twitter and Paypal in October.
Cabinet Office Minister Ben Gummer said in a statement: “No longer the stuff of spy thrillers and action movies, cyber-attacks are a reality and they are happening now.
“Our adversaries are varied – organised criminal groups, 'hactivists', untrained teenagers and foreign states."
Cyber security has been recognised as one of the greatest threats to business around the world, with the global cost of cyber crime estimated at $445 billion (£363 billion), according to the World Economic Forum’s 2016 Global Risks Report.
Public services such as the NHS are also targets for attack since they hold large amounts of personal data, according to Mr Gummer.
The Government said it will recruit more than 50 cyber-crime investigators and technical experts to work in the National Cyber Crime unit and vowed to invest further in training people to become experts in internet security.
Included in the strategy is a plan to work with private companies to block spam emails so they never reach users.
The Government announcement comes after MI5 head Andrew Parker told The Guardian that Russia “is using its whole range of state organs and powers to push its foreign policy abroad in increasingly aggressive ways – involving propaganda, espionage, subversion and cyber-attacks”.
A new national action plan is also being launched by Labour to teach young children about the dangers of online grooming. Activists have said child sexual abuse has evolved and proliferated with growing internet access.
