News of the World hacker Glenn Mulcaire may now face prosecution for obtaining the identities of people under witness protection, Panorama has learned.
He had discovered the new identities of four notorious offenders, including one of toddler James Bulger's killers, by hacking phones, the Met Police said.
The newspaper printed several stories about Robert Thompson's new life.
It is illegal to publish anything that might reveal the new identities of people under witness protection.
The scheme protects people whose lives are at risk after being released from prison or being witnesses in court.
The BBC's Panorama has discovered the four - who include Thompson, who along with Jon Venables was convicted of murdering two-year-old James Bulger in Merseyside in February 1993, and child killer Mary Bell - have only recently been told they had been targeted by private investigator Mulcaire.
The Met found evidence of Mulcaire's breach of the scheme when he was arrested in 2006, and an officer from its own witness protection scheme met others working on the force's initial phone-hacking investigation, but it has no record of any further action being taken.
And neither News International, who owned the now-defunct tabloid, or Mulcaire were reported to the attorney general for a possible contempt of court over breaches to High Court injunctions protecting the new identities.
Former Met head of counterterrorism Bob Quick told Panorama he would have expected senior officers to have been made aware that Mulcaire had obtained the new identities.
"I would be surprised if something of that sensitivity was not briefed up the command chain to very senior levels," he said.
In 2007, Mulcaire and NoW royal editor Clive Goodman were jailed for hacking phones of members of the royal household.
Former Met Deputy Assistant Commissioner Brian Paddick told Panorama: "The witness protection scheme is a very expensive operation to give people who've been convicted of very serious offences and people who are very vulnerable witnesses... a completely new identity, so they can have a completely fresh start.
"For that information to get into the hands of journalists is potentially putting people's lives at risk.
"I would have expected an immediate thorough investigation so that we could restore confidence in the witness protection scheme."
The Met has now reported Mulcaire to the attorney general, Dominic Grieve, who will decide what further action should be taken once ongoing prosecutions have concluded.
In 2009, after criticism the Met had failed to act on evidence that Mulcaire and other journalists had targeted hundreds of victims, former Assistant Commissioner John Yates decided there was no need for a fresh investigation into phone hacking.
But he told the programme he had never been briefed about Mulcaire's breach of the scheme.
He said had he been aware Mulcaire had used hacking to breach the witness protection scheme, he may well have come to a different conclusion.
The Met told Panorama Mulcaire had targeted a "small number of individuals" on the national scheme but there was no evidence police officers or staff had compromised their information.
A Met statement said: "Mulcaire obtained information on such individuals by using the same techniques as he used against celebrities, politicians and other individuals the newspapers were interested in.
"He 'blagged' personal details from third parties, used open sources and hacked the phones of people close to them."
Watch Hacking: Power, Corruption and Lies on BBC Two on 25 June on BBC iPlayer.