DWP exposed more than 6,000 disability claimants' NI numbers online

The Information Commissioner Office is examining the incident, while the DWP insists it takes its responsibility to protect data "very seriously"

The Department for Work and Pensions (DWP) left the confidential details of thousands of people unsecured on the internet for more than two years.

According to the Mirror, the exposed data included the National Insurance (NI) numbers of more than 6,000 individuals who had likely applied for disability benefit (PIP).

Analysis of the unsecured files revealed that they were published in March and June 2018 and included details of routine payments to the outsourcing firm Capita, which assesses peoples' eligibility for PIP.

The exposed speadsheets, now removed, contained details of payments for PIP assessments, "factual reports" and 6,842 NI numbers. Of those numbers, four were published in March 2018, while the rest were published in June 2018.

Analysis revealed that 401 NI numbers were duplicates, meaning that the NI numbers of 6,441 individuals were actually left unsecured online throughout the two-year period. No other personal data was exposed in the incident.

The data breach was first noticed by privacy rights group Big Brother Watch which notified the DWP.

The DWP removed one of the two files on Monday, and was due to remove another on Tuesday.

Jake Hurfurt, Head of Research & Investigations of Big Brother Watch, described the security incident as "a gross violation of privacy" of the people who are receiving disability welfare from the DWP.

The Information Commissioner's Office (ICO) is currently examining the data breach and could order a formal investigation into the incident.

A spokeswoman for ICO said that the DWP has informed the regulator about the incident, and that the Office is currently assessing the information provided.

Jonathan Reynolds, Shadow Secretary of State for Work and Pensions, commented: "This breach not only damages public trust in the Government but may also mean more taxpayers money is wasted due to Government incompetence."

"An apology and inquiry are urgently needed to ensure this never happens again."

The DWP is the UK's biggest public service department and is responsible for welfare, pensions and child maintenance policy. It administers the State Pension, as well as a range of working age, disability and ill health benefits, for around 20 million claimants.

A DWP spokesperson told the Mirror that it takes the responsibility to protect data "very seriously," and would soon publish the revised information online.

"While no one can be identified from the additional information published, we apologise for the mistake," the spokesperson said.