November 20, 2007

Chancellor faces up to UK's worst-ever data breach

HMRC under pressure after 25 million records go missing

By Christian Annesley

---

Chancellor Alistair Darling has blamed a breach of internal procedures at HM Revenue and Customs for the loss of 25 million child benefit records.

In a statement to the Commons that explained the circumstances behind today’s shock resignation of HMRC chairman Paul Gray, Darling revealed that last month a junior employee used the department’s internal mail system to send two password-protected discs that contained a full, unecrypted copy of HMRC’s data relating the payment of child benefit to the National Audit Office. But the discs never arrived.

Two more discs holding the same data were sent subsequently by registered post to the NAO and arrived and were returned safely.

The data breach is one of the world’s biggest ID protection failures, and all the more significant because bank account details are involved. The data lost includes parents’ and children’s names, addresses, dates of birth, child benefit and national insurance numbers, as well as bank account details. The 25 million records included details on 7.25 million families.

A police investigation has been launched into the incident, including staff interviews at HMRC.

Darling admitted it was “highly likely” that there had been breaches of the Data Protection Act. He said HMRC had clear instructions and rules in relation to the downloading and transmitting information, but these had been ignored.

Shadow chancellor George Osborne said the government needed to “get a grip” and deliver a basic level of competence.

He said the breach was the “final blow for the ambitions of this government to create a national ID database.”

Information commissioner Richard Thomas said: “This is an extremely serious and disturbing security breach. This is not the first time that we have been made aware of breaches at the HM Revenue and Customs – we are already investigating two other breaches. Incidents like these illustrate that any system is only as good as its weakest link. The alarm bells must now ring in every organisation about the risks of not protecting people’s personal information properly.”

Thomas said he was pleased that HMRC had “reported the breach to my office” and that the chancellor had appointed Kieran Poynter of PricewaterhouseCoopers to carry out an independent review.

“Searching questions need to be answered about systems, procedures and human error inside both HMRC and NAO,” Thomas added.

Workers’ unions also responded angrily to the breach, blaming the failure on the “enormous pressure being placed on HMRC by government-imposed job cuts.”

Mark Serwotka, general secretary of the Public and Commercial Services Union (PCS), said job cuts totalling 25,000 by 2011 and the recent merger and massive ongoing restructuring at HMRC had left it particularly vulnerable.

“With additional security checks expected to be put in place for people claiming and making enquiries about child benefit we urge the government to put extra resources into HMRC rather than continuing with cutting jobs,” he added.

HMRC said earlier this month after another, smaller security breach was made public that it had reviewed its arrangements and "introduced safeguards to prevent this happening in future."

Now read:

Lose an unencrypted laptop 'and face criminal action'

Gartner: UK banks could be forced to close accounts after HMRC data loss scandal

Capgemini to cull 20% of HMRC's Aspire IT staff

HMRC coy on Aspire profit sharing terms

HMRC extends Aspire outsourcing deal in bid to cut costs

HMRC taking 'precautionary measures' after loss of 15,000 records

Queen's Speech: Government boosts data sharing powers

Government defends tripling of HMRC's IT bill for Aspire

Revenue IT chief appointed chief operating officer

HMRC loses laptop with taxpayer data

Editor's blog

Newsletters

Sign up to our Weekly Round-Up for the past week’s not-to-be-missed news analysis and insight delivered straight to your inbox.