Sergey Nivens - stock.adobe.com

News

Sir Alan Bates hits out at Post Office ‘incompetence’ after data breach

Victims of the scandal react with anger at news the Post Office published a document containing their names and addresses on its website

By
Published: 20 Jun 2024 12:30

Campaigner Sir Alan Bates has hit out at the “utter incompetence” of Post Office bosses after he learned that a document containing the names and addresses of victims of the scandal was published on the Post Office website.

The document, titled “Confidential Settlement Deed,” was discovered by journalist Nick Wallis, and has since been removed from the website. A link to the document can still be found through a Google search at the time of writing, suggesting it had been online since 2019 – the URL now returns a “Page not found” error.

According to Wallis’s story published in The Daily Mail, it contains the names and addresses of all 555 subpostmasters who took part in the 2018/19 High Court case that proved bugs in the Post Office’s Horizon IT system were responsible for accounting losses for which the victims had been blamed and prosecuted.

Bates, who was recently knighted for his work in exposing the scandal and campaigning for its victims, told Computer Weekly: “The level of incompetence at the Post Office never fails to astound me. Their utter incompetence in failing to provide documents requested for disclosure and then disclosing highly confidential material on their website – it’s beyond belief. When are they going to start firing these people instead of giving them bonuses?”

The Post Office has been reprimanded on more than one occasion by Sir Wyn Williams, head of the statutory inquiry into the scandal, for its failures in disclosing important documents to the inquiry.

Christopher Head, a former subpostmaster and victim of the scandal, said he has written to Post Office CEO Nick Read, demanding answers as to how the document came to be available online. “As you can imagine, this has caused a great amount of upset, distress and anger amongst those whose data is now within the public domain,” wrote Head, according to a copy of the text posted on his Twitter account. 

“There are many who hadn’t shared details with their own families and others who are extremely traumatised by this whole scandal even today, and this has further impacted them,” he said. “Whether anyone would have accepted an apology at this stage is unknown, but I personally found it very telling that the response to The Daily Mail with the Post Office statement contained no apology or understanding of the severity of the impact on those postmasters and their families.”

Fight for compensation

Many of the subpostmasters affected are still fighting for compensation, three years since the first Court of Appeal hearing that exonerated them. Last month, the government passed a law that overturned the convictions of all of those whose appeals were yet to be heard.

“After everything that postmasters, postmistresses and their families have been through over the years, this is just another insult, and can only be described as a disgrace,” said Head.

Jasvinder Barang, a former subpostmistress and member of campaign group Justice for Subpostmasters Alliance (JFSA) that was set up by Bates, told Computer Weekly the data breach risked more than just personal information being shared.

“I am shocked and very angry,” she said. “It’s not just about our online safety, but our physical safety as well. They know where we live and our families could be in danger.”

Ron Warmington, a partner at Second Sight, the forensic accountants who uncovered evidence of bugs in Horizon and a potential cover-up by Post Office executives, also highlighted the unfortunate irony in confidential victim information being revealed: “The Post Office kept telling us how important it was to keep people’s information confidential during our investigation, and they have revealed it to the world. Sheer incompetence from the Post Office as usual.”

Update: 16:30 20 June 2024

Post Office chief executive Nick Read has apologised for the data breach, and said: "This is a truly terrible error and one for which at this stage I can only apologise." In a statement, the Post Office added: “We are investigating as an urgent priority how it came to be published. We are in the process of notifying the Information Commissioner’s Office (ICO) of the incident, in line with our regulatory requirements.”

The Post Office could face regulatory scrutiny from the ICO – under the Data Protection Act, it has a duty to report potential data breaches. The commissioner has the power to fine organisations up to £17.5m or 4% of their annual worldwide turnover, whichever is higher. 

A spokesperson for the ICO said: “Post Office Limited have made us aware of an incident and we are assessing the information provided."

The Post Office scandal was first exposed by Computer Weekly in 2009, revealing the stories of seven subpostmasters – including Alan Bates – and the problems they suffered due to accounting software. It is one of the biggest miscarriages of justice in British history (see below for timeline of Computer Weekly articles about the scandal, since 2009).

• Also read: What you need to know about the Horizon scandal •

• Also watch: ITV’s documentary – Mr Bates vs The Post Office: The real story •

Timeline: Computer Weekly articles about the scandal since 2009

Read more on Data breach incident management and recovery