Newcastle city council says it waited a week before advising the public that personal data and payment card details of thousands of local residents had been stolen because it did not want to hamper investigation of the incident.
The council admitted last week that names, addresses and payment card details of up to 54,000 Newcastle residents has been downloaded from an insecure server to an IP address outside the country. But the data security breach was discovered on 19 July.
A council spokesperson said: “We hadn't advised the general public earlier, after first detecting the issue late last Thursday, as it would have potentially obstructed both the investigation and the behind-the-scenes measures being put in place to lessen the chance of any misuse of this data.”
The stolen data includes names, addresses and card details from transactions between February 2006 and April 2007, mainly for payment of council tax, business rates, parking fines or council housing rent.
The incident is the latest in a string of high-profile data security breaches, many of which have involved laptops.
Other public bodies caught out include Worcestershire council, and the NHS.
A security audit carried out for the council by specialists found that the data had been wrongly placed on an insecure server and subsequently downloaded to a computer with an IP address registered in Israel.
The data is understood to have been placed on the insecure server as a result of human error.
Council chief executive Ian Stratford said: "We are now fully confident that our systems are properly robust, so we are continuing to receive payments by credit and debit cards.
“We very much regret that this situation has developed, although would again stress that there has been no indication of any fraud or loss, and that we spotted this situation through the thoroughness of our own security and checking systems."
The council said it shut down the servers concerned when it because aware of the problem and has since tightened security. It has informed banks and the Information Commissioner’s Office of the data security breach.
It is understood that card numbers were encrypted, although the council was unable to say immediately whether the other data was also protected by encryption.
An investigation involving the council, banks, the police and security experts is under way, but the council said there was no evidence that the data had been exploited for fraud so far.
Newcastle councillor John Shipley said leading members of the council had been briefed about the incident on Monday 23 July. "This is an extremely serious breach, which I was shocked to hear about,” he said.
“My first concern is that every possible measure should be put in place now to protect people whose data might have been compromised, and we have communicated this to the banks and credit card companies."