The Home Office lost the personal data, including names, nationalities, passport numbers and dates of birth, of 3,000 seasonal agricultural workers in March, it has been revealed.
The data was sent on two unencrypted CDs and lost in transit to the UK Borders Authority in March 2008.
The incident was reported to the Information Commissioner's Office but has only now been made public in the Home Office 2007-08 resource accounts, which were published on 8 August 2008.
The data was lost before the government introduced an encryption service, which must be used for all data sent by post.
Aside from the data security incident, the Home Office has also revealed the progress of its modernisation programme, which commenced in February 2001 with contractor Sirius, a specially constructed consortium of Fujitsu, PWC (who have now departed from the contract) and Global Crossing. Under the 10 year life span of the programme, Sirius will develop e-mail, intranet, extranet and telephone voice services, supporting an estimated 19,000 desktops at the Home Office.
"The contract is treated as off balance sheet with the separation of payment streams to the contractor for IT and telephony charged to the Operating Cost Statement," said the document.
The potential costs incurred if the Sirius IT contract was terminated is £12 million, the Home Office document added.