Thousands of people changed their bank account PIN codes yesterday as concern grew over the potential criminal abuse of the 25 million sets of personal details lost by Revenue & Customs. Banks and credit reference agencies were flooded with phone calls from child benefit claimants trying to protect details of their personal circumstances.

Many people altered their codes after advice to change any PINs linked to the names or birthdates of children or other family members.

It was revealed last night that the official responsible for Britain’s biggest breach of personal security was a 23-year-old junior at the Child Benefit Agency who could have been paid as little as £13,000 a year.

Whitehall sources said that the male IT worker had been authorised by senior managers at HM Revenue & Customs to copy and dispatch the files on two CDs in a blatant breach of all documented data security procedures.

The managers had been asked to send strictly protected information about Child Benefit claimants to the National Audit Office but reportedly refused to do so because editing the database would have been a costly exercise and they were under pressure from the Treasury to slash expenditure.

As the focus of the inquiry moves away from the 23-year-old junior – who is being kept away from the furore with a 24-hour media minder – his managers were left to explain who authorised him to download the data and provided him with whatever security clearance was necessary to do so.

Bankers attacked Alistair Darling yesterday over the Treasury’s six-day delay in informing them of the potential criminal threat to seven million accounts and for refusing to underwrite any losses arising from the loss of the records.

One senior banker told The Times: “They should have called in the cops earlier and they should have told us earlier.”

Mr Darling was first informed about the crisis on November 10, but did not tell bankers until November 16. A further two days passed before banking industry bodies were allowed to pass details to individual banks.

Angela Knight, chief executive of the British Bankers’ Association, implied that the banks would expect the Government to pay if fraud occurred in the wake of the security breach. She said: “This isn’t a bank responsibility. The banks didn’t lose the data.”

Police searching for the two missing CDs holding the data have been told that two more unencrypted discs with thousands of personal records also went astray in recent months.

Yesterday Edward Leigh, the Conservative chairman of the Commons Public Accounts Committee, said he had been informed that the NAO originally asked only for basic details about child benefit recipients – omitting information on personal bank accounts – but was told by “high level” officials that it would be “too burdensome” for Revenue & Customs to separate out this data.

Mr Leigh said that he had been given a copy of a briefing note written by NAO head Sir John Bourn for the Chancellor, which indicated that senior Revenue & Customs officials authorised the release of sensitive information. He said the note states that the NAO requested data on child benefit claimants in a “desensitised” form, with bank accounts and other personal data removed, in March.

Mr Leigh said the reason given for turning down the NAO request was that desensitising the information would require an extra payment to the data services provider EDS.

Shawn Williams, a solicitor who regularly receives CDs from Revenue & Customs, said there was a slapdash attitude to data security. “Sometimes there is no security at all, sometimes there are instructions telling you how to access the data, sometimes the password is just written on a compliments slip and included with the disc.”

The Times has learnt that the Information Commissioner is also unhappy with the Government’s handling of the situation and with the limited data security powers given to him by the Prime Minister.