More than 1,000 celebrities, government employees and politicians who have received honours had their home and work addresses posted on a government website, the Guardian can reveal.
The accidental disclosure of the tranche of personal details is likely to be considered a significant security breach, particularly as senior police and Ministry of Defence staff were among those whose addresses were made public.
Many of the more than a dozen MoD employees and senior counter-terrorism officers who received honours in the new year list had their home addresses revealed in a downloadable list, along with countless others who may believe the disclosure has put them in a vulnerable position.
Prominent public figures including the musician Elton John, the cricketer Ben Stokes, NHS England’s chief executive, Simon Stevens, the politicians Iain Duncan Smith and Diana Johnson, TV chef Nadiya Hussain, and the former director of public prosecutions Alison Saunders were among those whose home addresses were published.
Others included Jonathan Jones, the permanent secretary of the government’s legal department, and John Manzoni, the Cabinet Office permanent secretary. Less well-known figures included academics, Holocaust survivors, prison staff and community and faith leaders.
It is thought the document seen by the Guardian, which contains the details of 1,097 people, went online at 10.30pm on Friday and was taken down in the early hours of Saturday.
The vast majority of people on the list had their house numbers, street names and postcodes included.
A Cabinet Office spokesperson apologised for the error and said it had reported itself to the Information Commissioner’s Office. “A version of the new year honours 2020 list was published in error which contained recipients’ addresses,” the spokesperson said.
“The information was removed as soon as possible. We apologise to all those affected and are looking into how this happened. We have reported the matter to the ICO and are contacting all those affected directly.”
A member of the public contacted the Guardian after downloading the spreadsheet from the government website page where the 2020 new year honours list – which was drawn up and approved during Theresa May’s premiership – was posted.
“I couldn’t quite believe my eyes at first,” she said. “I thought maybe that’s just what they do. But then I checked past spreadsheets and saw there was nothing on those and I realised this must have been a catastrophic mistake.”
Experts said the nature of the breach made it difficult to remedy. “This could be catastrophic,” said prominent data rights lawyer Ravi Naik. “It is hard to put the information genie back in the bottle once it’s out. This quite sensitive data will spread like a virus and is extremely difficult to remedy.
“There is also a security risk to Ministry of Defence staff and I hope the Cabinet Office will be taking steps to remedy that. But you can’t get everyone to move house.”
He added: “It’s important to find out how many times that list was downloaded. You would hope they are taking appropriate steps to limit the damage and work backwards from who downloaded the list.”
Silkie Carlo, the director of Big Brother Watch, said: “It’s extremely worrying to see that the government doesn’t have a basic grip on data protection, and that people receiving some of the highest honours have been put at risk because of this.
“It’s a farcical and inexcusable mistake, especially given the new Data Protection Act passed by the government last year – it clearly can’t stick by its rules.”
The shadow Cabinet Office minister, Jon Trickett, said: “If the government can’t get sensitive details right then how can it possibly expect us to believe that it can sort out the big issues facing the country. This level of incompetence is unacceptable.”
The Cabinet Office is responsible for supporting the National Security Council and the Joint Intelligence Organisation. It coordinates the government’s response to crises and manages the UK’s cybersecurity.
The ICO, which can fine organisations for data breaches, said: “In response to reports of a data breach involving the Cabinet Office and the new year honours list, the ICO will be making inquiries.”
