HM Revenue and Customs (HMRC) has disciplined more than 600 staff for accessing personal or sensitive tax data without authority, writes Ali Hussain.

Treasury financial secretary Jane Kennedy said that in many cases the penalty for staff was dismissal.

HMRC says it was confident that taxpayers affected by the breach would not face a greater risk of fraud and that steps have been taken to prevent further problems.

Although HMRC would not reveal the kind of data or the people whose records were accessed, experts suggest that details of celebrity tax returns could have been a target.

A spokesman said: “HMRC has a strict policy forbidding staff to access customer records outside those required by their duties.” The number of staff involved represented less than 1% of HMRC's total employees.

This security breach marks a significant increase in the number of staff disciplined in recent years. There were 238 disciplined in 2005, 180 in 2006, and 192 in 2007.

Kennedy said: “Any [security] breach will result in the commencement of disciplinary proceedings. Each case is treated on its merits but in many cases the disciplinary penalty for breach is dismissal.”

He also revealed that since 2005, HMRC has had 11 data-security incidents that have been serious enough to be reported to the data-protection watchdog, the Information Commissioner's Office.

The HMRC is a regular target for fraudsters who send out e-mails that appear to be from HMRC to lure consumers into divulging credit card and bank account numbers.

But it has faced widespread criticism over recent high-profile data breaches. In November 2007, the chancellor, Alistair Darling, had to apologise following the loss of 25 million personal details of people claiming child benefits.

Two CDs containing the details were lost in the post. Darling blamed the loss on a junior official.