Aviva customer car insurance accident details stolen
Aviva is writing to tens of thousands of motorists after concerns that two employees sold details of people who had recently had accidents to claims companies.
Hundreds of them have since received calls from firms to persuade them to make personal injury claims.
The employees have been dismissed and police have arrested two people on suspicion of fraud.
Aviva has apologised to customers and alerted the authorities.
Bryan Comley has had his car insured with Aviva for several years.
Two years ago he was hit by another motorist.
No one was injured and the claim was quickly settled.
However, soon afterwards, Mr Comley started receiving calls to his mobile from claims companies, saying there were thousands of pounds set aside for him because of the accident.
He thought that Aviva had passed on his details to the claims companies, as he told BBC Radio 4's Money Box programme: "They said they were acting on Aviva's behalf almost, some of them."
Mr Comley did not think there was much he could do about it: "I assumed this was normal industry practice, that a car insurance company would disclose this information to third parties. I didn't know any better."
It was only two years later that Bryan has discovered that Aviva believe that details of his accident had been stolen by two of its employees and sold to the claims companies.
A letter from Aviva told him what happened, that the relevant authorities had been informed, and that no medical or financial details had been stolen.
It put the blame for the breach firmly on the claims industry: "As you may be aware, some personal injury lawyers and claims management companies are very keen to acquire accident victims' details. Aviva has long called for stricter regulation of these firms."
It then listed a freephone number that customers could ring.
Money Box listener Pauline phoned the number and asked what Aviva was doing to prevent a recurrence.
She said in an email to the programme that the response was "unconvincing".
The insurer's response has also not gone down well with Mike Crockhart, MP for Edinburgh West, who co-chairs the All-Party Parliamentary Group on Nuisance Calls: "They still appear to be a little bit in denial. The data that major companies hold has a value. It's up to those companies to make sure they manage that data. I think they need to come at it with fresh vigour."
Aviva said it was looking to see what it needed to do to prevent such incidents happening again.
It said it had first started identifying this problem last summer when it picked up on customer complaints.
But Money Box listeners say they had been receiving calls from claims companies as far back as three years ago, which they believe must have come from Aviva data.
When they phoned up to complain, they were told Aviva was definitely not the source of the data.
Ashley from East Sussex told Money Box "They swore blind they'd not passed my details on. I even suggested a rogue employee, and they dismissed my suggestion, making out I was even wrong for bothering them about this."
Aviva only identified that it was its data being uses at the end of last year.
It then finally began contacting both Aviva customers and people involved in car accidents where the other party was insured by Aviva.
In all, it says that is tens of thousands of motorists.
Hundreds have contacted the insurer to confirm they have been approached by claims companies.
It does not know the exact scale of the theft or when the data started being sold, which is the subject of a police investigation.
An Aviva spokesperson said: "We are of course sorry for the inconvenience this has caused Mr Comley. This was illegal activity. We identified it and immediately reported it to the police and the relevant financial authorities, and we are contacting affected customers.
"It is sadly the case that financial services are being targeted by unscrupulous claims management companies, who are very keen to acquire customer contact details so they can encourage compensation claims - for which they expect a percentage of any damages.
"Aviva has long called for stricter regulation of these firms and prosecution for any unlawful activity."
It said it would look at claims for compensation case by case.
The government has said it will act to stop the buying of stolen personal data by claims companies.
Kevin Rousell, head of the claims management regulation unit at the Ministry of Justice, said: "We do not tolerate bad practice from the companies we regulate and continue to drive malpractice out of the industry. We have closed down more than 200 rogue companies in the past year.
"We are changing the law to further toughen the regime, including introducing fines, and ensuring firms cannot buy in any contact details which have been gathered unlawfully."
City of London Police says two men have been arrested and released on bail on suspicion of fraud by abuse of position.