Hundreds of investors who have been put at risk of identity theft after a laptop containing their personal data was stolen from HM Revenue and Customs at the end of last month are having to pay to reduce the risk of future fraud.
The computer, which contained personal data including names, addresses and account numbers of individual investors, was stolen from the boot of a car belonging to a Revenue official who was carrying out a routine audit of a number of financial companies.
The Revenue will not disclose the name of the five companies that were being audited, but Standard Life and fund management company Liontrust have already confirmed publicly that they have been affected and now Cash has learnt that customers from Credit Suisse Asset Management have also been hit.
The Revenue has apologised for the incident and in a statement said: 'We very much regret the loss of some customer data provided to us by a number of financial institutions. The incident has been reported to the police and we are carrying out an urgent internal enquiry. HMRC places the utmost importance on the security of confidential material and we have in place very clear processes governing the handling of such material.' In its defence, a spokesman for the Revenue pointed out: 'The data on the laptop is protected by both a complex password and powerful encryption software.'
All the companies involved have now written to those whose details were on the stolen computer to alert them to the possibility of identity theft. However, the Revenue has not contacted any of the customers directly, instead issuing guidelines to the companies affected suggesting that customers can take further advice from Cifas, the UK's fraud prevention service. Cifas will monitor the credit files of those who are at risk of identity fraud for a £12 fee.
'The Revenue has the utmost responsibility to protect taxpayers' personal details and they have failed. I have had no apology or communication of any sort from the Revenue, they left Liontrust to do their dirty work,' says Ruth Sunderland, The Observer's business editor, who has a small amount in an Isa with Liontrust and whose details were on the stolen laptop. 'To add insult to injury, I have had to pay £11.75 to Cifas to try to protect myself against identity fraud, when none of this is my fault.'
Credit Suisse, which says that 'a limited number of individuals' had been affected, is paying the Cifas fee for its customers.
The biggest potential danger is to those customers whose personal financial details were on some hard-copy documents that were stolen along with the laptop.
Nigel Legge, chief executive of Liontrust, commented: 'HMRC have admitted that this was a breach of their own security guidelines, have conceded full responsibility and apologised. It is a little galling, though, that if a financial institution had done this they would have been subject to a fine.'
Building society Nationwide was fined almost £1m after a laptop containing sensitive customer data was stolen from one of its employees last November.
Alistair Darling 
British Chancellor of the Exchequer Alistair Darling announced to a shocked House of Commons today that two password-protected — but not encrypted — computer disks containing the entire Child Benefit database have been lost in transit between the offices of Her Majesty's Revenue and Customs (HMRC) in Washington, Tyne & Wear and the National Audit Office (NAO) in London, in what has been described as "one of the world’s biggest ID protection failures".

The database contains details of all families in the UK who receive Child Benefit — all families with children up to 16 years of age, plus those with children up to 20 years old if they are in full-time education or training — estimated to contain 25 million individuals in 7.25 million families. Among other items of information, the database contains names, addresses, dates of birth, child benefit and National Insurance numbers, and where appropriate, bank or building society account details.

The discs were created by a junior official at the HMRC in response to a request for information by the NAO, and were sent unregistered and unrecorded on 18 October using the courier company TNT — which operates the HMRC's internal mail system. When it was found that the discs had not arrived for audit at the NAO, a further copy of this data was made and sent — this time by registered mail — and this package did arrive. HMRC were not informed that the original discs had been lost until 8 November, and Darling himself was informed on 10 November.

The violation of data protection laws involved in the creation of the discs has led to strong attacks on the government's competence to establish the proposed National Identity Register, when all UK residents will have an identity card. Conservative Shadow Chancellor George Osborne described the loss of data as "catastrophic" and said "They the government simply cannot be trusted with people's personal information".

The Chairman of HMRC, Paul Gray, has resigned over the affair, and critics are calling for Darling to do likewise.

This is the third data embarrassment for HMRC in recent weeks — earlier this month it was reported that the details of over 15,000 Standard Life customers had been put on disk, and then lost en route from HMRC in Newcastle to Standard Life in Edinburgh — and last month a laptop containing the data of 400 people with high-value ISAs was stolen from the boot of a car belonging to a HMRC official who had been carrying out a routine audit.