HMRC slammed over major data breach

Investigators from the Independent Police Complaints Commission found that HMRC procedures for handling sensitive data were "woefully inadequate" and staff adopted a "muddle through" ethos to confidential personal records.

And a separate report by consultant Kieran Poynter found that last October's loss of two computer discs containing the names, addresses and bank details of every child benefit claimant in the country was "entirely avoidable" and raised "serious questions of governance and accountability" at HMRC.

The UK's data watchdog, Information Commissioner Richard Thomas, warned that he would prosecute the agency if it did not improve its handling of private information. He issued formal enforcement notices against HMRC and the Ministry of Defence, which was the subject of a third critical report into its loss of 600,000 recruits' details on a stolen laptop.

Chancellor of the Exchequer Alistair Darling apologised "unreservedly" for the security breach, and assured the House of Commons that measures were already under way to tighten up procedures at HMRC.

The Government has accepted all 45 of Mr Poynter's recommendations and the new chairman of HMRC Mike Clasper has committed £155 million over the next three years to improving security, he said.

But his Conservative shadow George Osborne said that the reports gave a "truly devastating account of incompetence and systemic failure at the heart of this Government".

He said that the reports had "comprehensively blown out of the water" the claims made by Mr Darling and Prime Minister Gordon Brown at the time of the incident that the breach was the responsibility of a junior official breaking the rules. The IPCC report found that no individual was to blame for the loss of the discs, which have never been found.

Instead, the Government agency was accused of wholesale failings in institutional practices and procedures. Staff worked on confidential data without adequate support, training or guidance and there was no coherent strategy for mass data handling.

Officials were so ignorant about data security that when the CDs were lost, they simply sent another set, and it was three weeks before the loss was reported, setting in train a series of events which sparked a national outcry.