By Paul Lewis
BBC Radio 4's Money Box
Standard Life is one of two companies affected by the breach
The data was on a CD sent from the Revenue office in Newcastle to the company's headquarters in Edinburgh.
But the disc containing names, national insurance numbers, dates of birth and pension data never arrived at its intended destination.
HMRC and Standard Life have warned those at risk to be "vigilant".
How the breach occurred
The Revenue routinely sends CDs containing personal data on taxpayers to the insurance companies which hold their pensions.
A month ago a CD containing the names, national insurance numbers, dates of birth and pension plan numbers of nearly 15,000 Standard Life customers was lost by a courier taking it from the Revenue national insurance contributions office in Newcastle to the insurer's headquarters in Edinburgh.
We have... seen no indications of any suspicious activity
John Gill, Standard Life's director for customer services
Warning letters have only now been sent to customers by HMRC and Standard Life, five weeks after the data breach occurred.
One customer, Carolyn, was not happy about the delay.
"This happened at the end of September and it is a month before notification.
"They are saying that addresses were not on there, but if someone has your surname and date of birth it is not that difficult to track you down."
Standard Life's director for customer services, John Gill, told Money Box on Radio 4, "We have no evidence that the disc has fallen into third party hands and we have also been closely monitoring all the accounts and have seen no indications of any suspicious activity."
Encryption
The Revenue refused to say "on security grounds" whether the information was encrypted.
John Gill said it was "in a coded format that would not be easy to read".
But the joint letter from the two organisations warned customers that "there is a possibility that your personal data could be accessed by someone other than HMRC or Standard Life."
HMRC INFORMATION For further information, the HMRC has set up the following helplines:
(lines open from 0830 to 1700 Monday to Thursday and 0830 to 1630 on Fridays) Surname beginning A-E: 0845 91 50249
or 0845 91 50134 Surname beginning F-J: 0845 91 50242
or 0845 91 50139 Surname beginning K-O: 0845 91 50267
or 0845 91 50244 Surname beginning P-T: 0845 91 50201
or 0845 91 58845 Surname beginning U-Z: 0845 91 50139
John Gill confirmed that Standard Life was still receiving discs from the Revenue and was "awaiting further info from the Revenue on how they propose to do this going forward."
This latest incident is the second time in a month that the Revenue has admitted losing taxpayers' details.
Early in October it revealed that a laptop had been stolen containing data on up to 2000 people with investment ISAs.
BBC Radio 4's Money Box was broadcast on Saturday, 3 November 2007 at 1204 GMT.
Alistair Darling 
British Chancellor of the Exchequer Alistair Darling announced to a shocked House of Commons today that two password-protected — but not encrypted — computer disks containing the entire Child Benefit database have been lost in transit between the offices of Her Majesty's Revenue and Customs (HMRC) in Washington, Tyne & Wear and the National Audit Office (NAO) in London, in what has been described as "one of the world’s biggest ID protection failures".

The database contains details of all families in the UK who receive Child Benefit — all families with children up to 16 years of age, plus those with children up to 20 years old if they are in full-time education or training — estimated to contain 25 million individuals in 7.25 million families. Among other items of information, the database contains names, addresses, dates of birth, child benefit and National Insurance numbers, and where appropriate, bank or building society account details.

The discs were created by a junior official at the HMRC in response to a request for information by the NAO, and were sent unregistered and unrecorded on 18 October using the courier company TNT — which operates the HMRC's internal mail system. When it was found that the discs had not arrived for audit at the NAO, a further copy of this data was made and sent — this time by registered mail — and this package did arrive. HMRC were not informed that the original discs had been lost until 8 November, and Darling himself was informed on 10 November.

The violation of data protection laws involved in the creation of the discs has led to strong attacks on the government's competence to establish the proposed National Identity Register, when all UK residents will have an identity card. Conservative Shadow Chancellor George Osborne described the loss of data as "catastrophic" and said "They the government simply cannot be trusted with people's personal information".

The Chairman of HMRC, Paul Gray, has resigned over the affair, and critics are calling for Darling to do likewise.

This is the third data embarrassment for HMRC in recent weeks — earlier this month it was reported that the details of over 15,000 Standard Life customers had been put on disk, and then lost en route from HMRC in Newcastle to Standard Life in Edinburgh — and last month a laptop containing the data of 400 people with high-value ISAs was stolen from the boot of a car belonging to a HMRC official who had been carrying out a routine audit.