HMRC data blunder to cost at least £500m

UK banks will be forced to take expensive emergency measures after the HMRC data incident

The UK government's loss of sensitive information compromising 25 million individuals could force British banks to take "enormously expensive" emergency measures, Gartner warned today.

Avivah Litan, vice president and distinguished analyst at Gartner, said: " The type of data lost could be enormously valuable to identity thieves and other criminals who could use stolen account numbers to take over bank accounts.

"This is why bank account numbers typically sell on the US black market for as much as $400 compared with $5 for credit card numbers.

"Even the possibility of such a move would force UK banks to take emergency measures, including closely monitoring all fund transfers out of potentially affected accounts."

This would be especially problematic owing to the UK's implementation of the Faster Payments initiative, which calls for almost immediate fund transfers.

Gartner believes that it is "fortunate", under the circumstances, that the initiative has been delayed until 2008.

The warning comes after HM Revenue & Customs lost computer disks containing large amounts of confidential information, including names, addresses, dates of birth and bank account information.

The missing disks, which were apparently lost while being transported, may include information on as many as 25 million individuals, including recipients of Child Benefit.

"If evidence emerges that the lost data has fallen into criminal hands, UK banks could be forced to close down millions of accounts and reopen new ones at enormous cost," said Litan.

"The banks' customers would also face considerable inconvenience, because automatic payments and transfers would have to be set up again, and debit cards might have to be reissued."

The potential costs to the UK banking system, and to the economy as a whole, could be as high as £244m, according to Gartner, based on a conservative estimate of just under £10 per account.

Litan added that the chances of a true data loss resulting in identity theft are usually extremely low, typically less than one per cent for any given individual.

But the analyst warned that the media attention means that criminals are likely to pursue the lost data as vigorously as the authorities.