Thousands at risk after data loss

By Paul Lewis
BBC Radio 4's Money Box

Standard Life is one of two companies affected by the breach

Around 15,000 Standard Life customers could be at risk of fraud after their personal details were lost by HM Revenue & Customs (HMRC).

The data was on a CD sent from the Revenue office in Newcastle to the company's headquarters in Edinburgh.

But the disc containing names, national insurance numbers, dates of birth and pension data never arrived at its intended destination.

HMRC and Standard Life have warned those at risk to be "vigilant".

How the breach occurred

The Revenue routinely sends CDs containing personal data on taxpayers to the insurance companies which hold their pensions.

A month ago a CD containing the names, national insurance numbers, dates of birth and pension plan numbers of nearly 15,000 Standard Life customers was lost by a courier taking it from the Revenue national insurance contributions office in Newcastle to the insurer's headquarters in Edinburgh.

We have... seen no indications of any suspicious activity John Gill, Standard Life's director for customer services

A second CD containing data on some customers of an unnamed second firm has also gone missing.

Warning letters have only now been sent to customers by HMRC and Standard Life, five weeks after the data breach occurred.

One customer, Carolyn, was not happy about the delay.

"This happened at the end of September and it is a month before notification.

"They are saying that addresses were not on there, but if someone has your surname and date of birth it is not that difficult to track you down."

Standard Life's director for customer services, John Gill, told Money Box on Radio 4, "We have no evidence that the disc has fallen into third party hands and we have also been closely monitoring all the accounts and have seen no indications of any suspicious activity."

Encryption

The Revenue refused to say "on security grounds" whether the information was encrypted.

John Gill said it was "in a coded format that would not be easy to read".

But the joint letter from the two organisations warned customers that "there is a possibility that your personal data could be accessed by someone other than HMRC or Standard Life."

HMRC INFORMATION For further information, the HMRC has set up the following helplines: (lines open from 0830 to 1700 Monday to Thursday and 0830 to 1630 on Fridays) Surname beginning A-E: 0845 91 50249 or 0845 91 50134 Surname beginning F-J: 0845 91 50242 or 0845 91 50139 Surname beginning K-O: 0845 91 50267 or 0845 91 50244 Surname beginning P-T: 0845 91 50201 or 0845 91 58845 Surname beginning U-Z: 0845 91 50139

John Gill confirmed that Standard Life was still receiving discs from the Revenue and was "awaiting further info from the Revenue on how they propose to do this going forward."

This latest incident is the second time in a month that the Revenue has admitted losing taxpayers' details.

Early in October it revealed that a laptop had been stolen containing data on up to 2000 people with investment ISAs.

BBC Radio 4's Money Box was broadcast on Saturday, 3 November 2007 at 1204 GMT.