HMRC loses data for 25 million people

HM Revenue and Customs (HMRC) has lost the personal details of 25 million people in receipt of child benefit.

The information contained on discs includes the names or parents and children, addresses, National Insurance numbers and, in some cases, the bank or building society details of those claiming child benefit.

In a Commons statement, Chancellor Alistair Darling said that two discs containing details of the 7.25 million families claiming child benefit, sent to the National Audit Office (NAO), failed to reach the addressee.

The blame was put on a junior official who did not follow procedure. The Chancellor said the "full copy of the data" was sent to the NAO by courier - not by recorded or registered mail. When it transpired the discs hadn't arrived, the same official sent the information again - this time by registered post.

Although the police are currently investigating and searching both the NAO and HMRC offices, the loss effectively means the personal details of every family in the country with a child under 16 have gone missing.

This is the second time in a month that HMRC has been involved in the loss of people's personal data. It lost the details of around 15,000 Standard Life customers after data on a CD sent from the Revenue's Newcastle office to the company's headquarters in Edinburgh failed to arrive.

HMRC and Standard Life have warned those at risk to be "vigilant" as the disc contained names, National insurance numbers, dates of birth and pension data.

Although Paul Gray, the chairman of HMRC has resigned, the Tories have stepped up the pressure on the Darling. In a briefing note the party pointed out that 41 laptops have been stolen from HMRC over the past 12 months.

Information Commissioner Richard Thomas has said the latest incident is an extremely serious and disturbing security breach and that the ICO was already investigating two other breaches by the HMRC.

The data loss, which has been called "one of the world's biggest ID protection failures", is unacceptable, according to privacy experts.

"It is staggering that an organisation responsible for the data of over 25 million child benefit claimants is still copying data onto CD's and not ensuring its full protection through encryption techniques," said Brian Spector, general manager for content protection group Workshare.

"It has never been acceptable for businesses or government departments to lose data but in today's information society, the flagrant disregard for the protection and security of this type of data is not acceptable."

Responses from payment industry organisation Apacs and the banking industry, however, are urging people not to panic. They said that there has been "no evidence that the data has not fallen into criminal hands nor that any fraud has been attempted as a result of this incident".

The HMRC has set up a Child Benefit Helpline on 0845 302 1444 for customers who want more details.

The banking industry also said it wanted to reassure people that "sort code and bank account, national insurance number, date of birth, name and address details are not enough in themselves for an ID fraudster to access your bank account - as additional security information and passwords are always required" .