HM Revenue & Customs has suffered seven “significant” breaches of security involving the loss of personal data in the past 2½ years, the organisation’s new acting chairman disclosed yesterday.

Dave Hartnett said that the breaches, which took place after Revenue & Customs was created from the merger of two agencies in April 2005, could represent a “systemic failure”.

Last month Revenue & Customs lost two computer discs containing the personal details of 25 million people.

Alistair Darling, the Chancellor, is facing a mounting bill from Scotland Yard for the sprawling, and so far fruitless, investigation into the child benefit data fiasco.

The Times has learnt that the Metropolitan Police will soon begin negotiations with the Treasury over the cost of the search – in effect Britain’s biggest and most expensive lost property inquiry – which has cost an estimated £500,000 to date.

Officers have visited offices, post rooms, mail depots and rubbish tips from Cumbernauld in Scotland to Rainham in Essex. There are 32 Yard detectives assigned to the operation under Assistant Commissioner Janet Williams, who has been asked by the Chancellor to provide him with regular updates on the search.

Other police forces, including North-umbria, Greater Manchester Police, Strathclyde and Leicestershire, are expected to charge the Treasury for the use of their resources.

The discs became lost in the post when they were sent from a HM Revenue & Customs office on Tyneside to the National Audit Office in London on October 18. Giving evidence to the Commons Treasury subcommittee yesterday, Mr Hartnett acknowledged that problems relating to the losses could be systemic. “I think that it may well do,” he told the committee.

George Osborne, the Shadow Chancellor, said that Mr Hartnett’s admission had “blown a hole” in claims by Mr Darling that the loss of the records was the mistake of a single junior official.

“The public will now expect the Chancellor to come clean and explain exactly when and how these previous losses of personal information took place,” he said.

“Alistair Darling’s credibility is hanging by a thread. He is running out of time to reassure the British public that he’s capable of getting a grip.”

Mr Hartnett said yesterday that the other losses included a disc containing banking information, which was mislaid by Revenue & Custom’s information technology partner in 2006. Although the disc was subsequently recovered, the breach was reported to the information commissioner.

“We introduced at that stage more stringent rules,” Mr Hartnett said. “We set out in 2006 to learn lessons in relation to security and to tighten things up.”

Paul Gray resigned as chairman of Revenue & Customs last month when the worst of the data losses was made public. He has since taken up another Whitehall post.

Despite extensive police inquiries, the child benefit discs have not been found and, in a sign of growing desperation, Revenue & Customs yesterday offered a £20,000 reward for information leading to their recovery.

Police said that the inquiry has been “particularly challenging” not least because offices are littered with identical computer discs and padded envelopes.

The police spokesman said: “To date there is no evidence that the lost data has ended up in criminal possession. However, in order to ensure the public is protected, work is being conducted within the law enforcement agencies to ensure that all possible prevention measures are being taken.”

Revenue & Customs has already agreed to pay the additional costs for Met officers involved in the hunt for the missing discs.

Times Recommends

• Protecting ourselves from Eurocreep
• The rise of Japan’s 'girlie man' generation
• Why write to a killer on death row?