Sensitive personal data including names, addresses and postcodes has been made publicly available on the website of delivery firm Parcelforce.
The data could seen by anyone using Parcelforce's mail-tracking service, according to the BBC.
Entering a delivery number into the 'Track and Trace' function on the website displayed information including addresses and signatures of unconnected deliveries, reporters found.
Parcelforce, part of Royal Mail, said the error occurred after work on its computer system on Wednesday night and early Thursday morning. It said the problem had now bee rectified.
The Information Commissioner’s Office said it “will be contacting Parcelforce to establish how this security breach occurred and to find out what steps it will be taking to ensure that such a breach cannot happen again”.
"Any organisation which processes personal information must ensure that adequate safeguards are in place to keep that information secure,” the spokesperson added.