The personal details of 25 million children and their parents were lost because senior civil servants did not tell staff how to protect sensitive data.

The loss of the names and addresses of every child in Britain and the financial details of ten million parents last autumn was the direct result of a Whitehall shake-up overseen by Gordon Brown, said the official report published yesterday.

Alistair Darling pointedly failed to defend his predecessor as he was forced into a humiliating apology on the day that four separate reports detailing failures to protect data across Whitehall were published.

The account by Kieran Poynter, a management consultant, of the loss of two discs containing complete child benefit records concludes that senior managers did not tell demoralised staff about rules on handling sensitive data, or take responsibility for keeping personal records safe.

The loss was not the fault of any individual but arose from “serious institutional deficiencies” at HM Revenue & Customs (HMRC), a department Mr Brown, as Chancellor, created three year ago.

A second investigation by the Independent Police Complaints Commission agreed there was “no evidence whatsoever” of any misconduct but blamed a “muddle-through” ethos.

The reports contradict claims by Mr Brown in November that a junior official broke data-handling rules.

Mr Darling distanced himself from attempts to smear junior officials for the child benefit blunder yesterday as he offered “an unreserved apology” in the Commons yesterday.

The current Chancellor, the target of speculation about a Cabinet reshuffle this week, also failed to defend his predecessor's handling of the merger between the Inland Revenue and Customs after Mr Poynter's conclusions. His report found “information security was not the management priority it should have been”, and structures and governance were unnecessarily complex, without clear lines of accountability.

George Osborne, the Shadow Chancellor, said that the investigations revealed a “truly devastating account of incompetence and systemic failure at the heart of this Government”. It was, he said, “a guide on how not to govern”. Later Mr Osborne said that Mr Darling “could hardly have made it clearer he wanted to distance himself from the failings of his predecessor”.

Treasury officials said it was not possible to say whether anyone had been disciplined, since staff had been given immunity from prosecution while the search for the discs was under way.

Richard Thomas, the Information Commissioner, announced that he would serve enforcement notices on both HMRC and the Ministry of Defence, which was criticised sharply over the theft of a laptop computer with the records of 600,000 recruits.

The Government did its best to hide its embarrassment by fielding Sir Gus O'Donnell, the Cabinet Secretary, who published a separate report proposing a series of technical recommendations. All civil servants will now have to be regularly trained in data handling and protection, and any laptops containing sensitive information will have to be encrypted if they are taken out of Whitehall.

Professional “hackers” will also be asked to test how robust the new systems are to ensure that the data is properly secured. In addition, all staff will have to assess what information should be sent to them, either by post or e-mail, through “privacy impact assessments”. Security roles are to be standardised across Whitehall to ensure that someone is clearly responsible for data handling in each office.

Mr Thomas served notice that he would monitor each department and under laws going through Parliament he will obtain the right to fine laggards. He said: “It is deeply worrying that many other incidents have been reported, some involving even more sensitive data. It is of fundamental importance that lessons are learnt.”

Jonathan Baume, general secretary of the FDA, which represents senior civil servants, said the reports pointed to “systematic and institutional failure” on data security and highlighted low staff morale.

The four reports

— Sir Edmund Burton, chairman of the Information Advisory Council, said that the loss of a laptop computer with the records of 600,000 Service recruits was “an inevitable outcome of a series of failings in governance, process and leadership”. Sir Edmund, who was brought in after a laptop was stolen from the parked car of a Royal Navy recruit in January, said that the losses were partly because of a failure of supervision and little knowledge of the Data Protection Act. He said the Armed Forces now recruited from the “Facebook Generation” among whom a culture of “rapid, often uninhibited, exchange of information” was the norm

— A 59-page report from the Independent Police Complaints Commission (IPCC) said that there was a “woefully inadequate system” at HM Revenue & Customs, where staff had no support, training or guidance about how to handle sensitive data. Gary Garland, the IPCC commissioner responsible for Revenue & Customs, said that staff were working on a “muddle-through” ethos and were so ignorant that when the CDs were lost they simply sent another set

— An independent report by Kieran Poynter, the chairman of PricewaterhouseCoopers, found that more than 30 HMRC officials were implicated in the loss of the discs, but said none of them should be held responsible because they had received “little or no information security training”

— The Cabinet Office report set out how the Government intends to improve its data security measures

Times Recommends

• An officer and a gentle woman
• Dame Helen Mirren is worthy of the Epidaurus
• Foods that can help to prevent swine flu