At least two more CDs that could leave thousands of people open to identity fraud have been reported missing by staff at HM Revenue & Customs this week, The Times has been told.

Police have started an investigation into the loss of the unencrypted files, which went missing in transit from tax offices in Washington, Tyne & Wear, and contain “sensitive information” including national insurance numbers and dates of birth. They were sent to offices in London and are yet to be accounted for.

The loss of these files are in addition to a series of recent blunders by HMRC, including the announcement this month that a CD-Rom that contained information on 15,000 Standard Life customers had been lost.

The latest disclosure will increase the pressure on Alistair Darling, the Chancellor, who faced calls yesterday for his resignation over the loss of details of 25 million Britons from the Washington office of HMRC.

The police investigation may be expanded as detectives search for at least four missing CDs. Each would be considered a treasure trove of information by fraudsters. A source said: “There has been a calamitous breakdown in communication that has meant that files were being sent from the Revenue offices without proper authorisation. Staff are only now realising the seriousness of the situation and admitting to handling or sending out unencrypted files. The police are aware of these.”

The allegations of newly missing files were made by members of staff at the tax centre, some of whom appeared to be unaware of the rules governing data protection. They told officers that the files were sent to offices in Central London and have not been accounted for. The files do not, unlike the two CDs lost in transit to the National Audit Office in London, include bank account details. However, the information could be used by fraudsters to apply for credit.

Officers were last night continuing their search at the HMRC’s three-storey offices in Washington for the CDs that were destined for the National Audit Office. Detectives are understood to be satisfied that the missing package never arrived at its intended destination. Officers were seen by staff peering down radiator grilles, looking under desks and sifting through stacks of unopened post in the hope of finding the missing CDs in an envelope.

Meanwhile, detectives are trying to piece together exactly what happened on October 18, when the CDs were posted. The Metropolitan Police Specialist Crime Directorate is conducting the investigation under the charge of Acting Assistant Commissioner Janet Williams.

There was no sign yesterday of the junior official at the child benefit office who has been blamed for the blunders that led to the information going astray. An HMRC spokeswoman would not confirm that he had been suspended but said that he would face disciplinary proceedings that could lead to his dismissal.

Further questions about the standards of data protection at HMRC were raised yesterday by a solicitor who works routinely with the prosecution arm of the HMRC. Shawn Williams, of Rose, Williams & Partners, a legal firm in Wolverhampton that deals with tax fraud cases, said that his firm frequently received discs that contained personal data from the HMRC with the password included. “Sometimes there is no security at all, sometimes there are instructions telling you how to access the data, sometimes the password is just written on a compliments slip and included with the disc,” he told The Times.

The HMRC has a history of losing sensitive information on unencrypted CDs. This month it emerged that it had lost confidential data on more than 15,000 people after a CD-ROM was lost in transit as it was sent from its office to the Standard Life pensions department in Edinburgh. A further CD-Rom containing data on customers of an unnamed second company was also reportedly missing. The Information Commissioner is investigating the breach involving Standard Life. A spokesman for the company said yesterday that HMRC and the police had not been able to locate the discs.

In August a laptop that contained sensitive financial details of about 400 people with ISAs was stolen after being left in a car. In May HMRC posted details of the family tax credits of 42,000 families to other people after an apparent “printer error”.

A spokeswoman for HMRC declined to comment on the disclosures by The Times last night. “We cannot comment ahead of the review,” she said.

Lines of inquiry

The Government has ordered five separate inquiries into the fiasco:

— Scotland Yard’s Specialist Crime Directorate is conducting the search for the two discs and looking for any criminal activity

— The Information Commissioner’s Office is examining a breach of data protection law. It has new powers to conduct spot checks on government data security

— The Independent Police Complaints Commission has been asked “to identify the causes . . . and consider whether relevant local and national policies and guidelines were complied with”

— Sir Gus O’Donnell, the Cabinet Secretary, will enlist security experts to ensure that every department and agency checked procedures for keeping data safe

— The Chancellor has also asked PriceWaterhouseCoopers to report on HMRC’s data security