Revenue chief Paul Gray resigns
The head of HM Revenue and Customs (HMRC) has resigned after it was revealed in parliament that the personal details of 25 million Britons had been "lost in the post".
Chancellor of the Exchequer Alistair Darling said in a statement that two CDs with the details of 25 million families had been sent to the National Audit Office by courier firm TNT but failed to arrive.
The material was apparently put in the post by a junior employee at the HMRC office in Washington, Tyne & Wear.
The disks, which were password protected but not encrypted, contained names, addresses, dates of birth, child benefit numbers, National Insurance numbers and bank or building society account details.
Paul Gray, chairman of HMRC, has already resigned and opposition MPs are calling on Darling to do likewise.
"The lost bank account numbers, names and addresses represents a gold mine for thieves and is much more valuable than credit card numbers or taxpayer ID numbers," said Avivah Litan, vice president at Gartner Research.
"Bank account numbers sell for the highest price on the black market, between $30 and $400, which is significantly more than the 50 cents to $5 that criminals pay for credit cards.
"If evidence emerges that the data fell into criminal hands, the UK banks may be forced to close the 15 million accounts and issue new ones at an enormous cost to them and a major inconvenience for their customers."
This is the third in a series of data breaches at HMRC. The organisation lost the details of a number of high net worth individuals in October, and banking details for 15,000 savers went missing earlier this month when a laptop was stolen.
"Another week and another high profile data breach for the government," said Joseph Hoban, vice president at data protection firm GuardianEdge.
"This is not the first time that public data has been compromised and, if lacklustre security continues to rule, it certainly will not be the last.
"It is time that tougher security measures were taken to protect our most confidential files. Securing two disks with only a password is not sufficient."
Darling has described the incident as "extremely regrettable" but has resisted calls for his resignation.
The loss has also sparked renewed calls for a data breach law that would force the government and companies to inform people if their data had been put at risk.
"California introduced data breach notification legislation some time ago, which compels businesses to inform customers if their personal data may have been compromised," said Richard Turner, vice president of sales at security firm RSA.
"The introduction of similar legislation would not only be a significant step in combating fraud, but constitutes a basic human entitlement.
"Public awareness of security breaches would serve to focus organisations on ensuring that confidential information is adequately protected, and enable the public to take appropriate safeguards in the event of a compromise."
Whitehall admits to huge online tax fraud 13 Dec 2005 Scale of ID theft far worse than originally admitted
£30m fraud hits UK Tax Credit website 05 Dec 2005 Applications site closed as identity fraud emerges
EDS to pay £71m in compensation to HMRC 24 Nov 2005 Public sector supplier has made no formal acceptance of blame
Alistair Darling 
British Chancellor of the Exchequer Alistair Darling announced to a shocked House of Commons today that two password-protected — but not encrypted — computer disks containing the entire Child Benefit database have been lost in transit between the offices of Her Majesty's Revenue and Customs (HMRC) in Washington, Tyne & Wear and the National Audit Office (NAO) in London, in what has been described as "one of the world’s biggest ID protection failures".

The database contains details of all families in the UK who receive Child Benefit — all families with children up to 16 years of age, plus those with children up to 20 years old if they are in full-time education or training — estimated to contain 25 million individuals in 7.25 million families. Among other items of information, the database contains names, addresses, dates of birth, child benefit and National Insurance numbers, and where appropriate, bank or building society account details.

The discs were created by a junior official at the HMRC in response to a request for information by the NAO, and were sent unregistered and unrecorded on 18 October using the courier company TNT — which operates the HMRC's internal mail system. When it was found that the discs had not arrived for audit at the NAO, a further copy of this data was made and sent — this time by registered mail — and this package did arrive. HMRC were not informed that the original discs had been lost until 8 November, and Darling himself was informed on 10 November.

The violation of data protection laws involved in the creation of the discs has led to strong attacks on the government's competence to establish the proposed National Identity Register, when all UK residents will have an identity card. Conservative Shadow Chancellor George Osborne described the loss of data as "catastrophic" and said "They the government simply cannot be trusted with people's personal information".

The Chairman of HMRC, Paul Gray, has resigned over the affair, and critics are calling for Darling to do likewise.

This is the third data embarrassment for HMRC in recent weeks — earlier this month it was reported that the details of over 15,000 Standard Life customers had been put on disk, and then lost en route from HMRC in Newcastle to Standard Life in Edinburgh — and last month a laptop containing the data of 400 people with high-value ISAs was stolen from the boot of a car belonging to a HMRC official who had been carrying out a routine audit.