BUNGLING officials have exposed 25 million people to fraud by losing detailed personal information.

The slip-up by an employee of HM Revenue and Customs which resulted in two discs, containing unencrypted data on everyone who claims child benefit, getting lost in the post is a disaster for the government.

And it creates a risk of ID theft and bank fraud for about half the country's population.

The information that has been lost includes names, addresses, national insurance numbers, dates of birth and full names of children. For people who have the benefit paid directly into their bank accounts the data includes bank account numbers and sort codes.

No matter how careful you are about shredding documents which contain sensitive information and not revealing passwords or pin numbers it seems as soon as you give any personal information to a third party you are exposing yourself to a level of risk.

While there is no evidence that these details have fallen into criminal hands the government has admitted that they don't know where they are.

Sean Matthews, technical director at Poole-based IT experts Blue Chip Data Systems, said: "There are many proven, secure electronic methods available for the transmission of this type of data between trusted parties. It does seem unbelievable that two government offices do not have this functionality, like the military does.

"However, the more worrying concern is how a low-level government employee can so easily extract this type of information from the system without anyone being aware.

"You have to ask whether the employee should have been able to access information of this sensitivity with their level of clearance. If not, where were the controls to prevent this from happening?

"If they should have been able to access the data, should they then have been able to move this data onto unsecured removable discs?

"The IT security policy has failed and must be reviewed immediately to ensure that employees understand and comply with it."

The Data Protection Act was supposed to prevent this kind of problem but it does not seem to be effective at preventing large-scale loss of privacy.

After this debacle would anyone trust the government to run an ID card system?