Northern Ireland's Department of Justice has been fined £185,000 for auctioning off a filing cabinet that contained personal information about victims of a terrorist attack.
The locked cabinet was one of 59 sold off by the Compensation Agency in 2012.
When the buyer forced it open, they found it contained documents about injuries suffered, family details, and confidential ministerial advice.
Justice Minister David Ford said it was "an unfortunate breach".
He said it was "caused by simple human error and not a systemic problem within the department".
The fine was imposed by the Information Commissioner's office, which looks after data protection issues.
Its assistant commissioner for Northern Ireland, Ken Macdonald, said: "This is clearly a very serious case.
"While failing to check the contents of a filing cabinet before selling it may seem careless, the nature of the information typically held by this organisation made the error all the more concerning.
"The distress that could have been caused to victims and their families had this fallen into the wrong hands is self-evident."
The buyer of the cabinet alerted the police, and it was returned to the Department of Justice.
Mr Ford said the Information Commissioner was alerted as soon as his department became aware of the breach, and Stormont's justice committee was subsequently informed.
"We are satisfied that none of the information was compromised and none of the other cabinets sold contained any files," he said.
"Detailed procedures have now been implemented to ensure that, in future, any personal data contained in furniture that is being disposed of will be dealt with securely."
The fine was reduced to £148,000 for early payment.