The UK information commissioner is investigating the leak of thousands of emails containing personal information from the controversial solicitors' firm ACS:Law after the company's website came under sustained attack by online activists.

Tens of thousands of broadband users may have had private information – including their addresses and credit card details – leaked online in the aftermath of a prolonged attack by users protesting against the methods used by ACS:Law to pursue alleged file sharers.

Now people who have previously received letters from the company demanding money are being warned to beware of unsolicited calls from criminals who have downloaded the messages – while people who have paid fines via credit cards are being warned to watch out for unusual transactions.

The website went offline after users of the online messageboard 4Chan orchestrated a sustained attack on it, putting the site offline for much of the week. A file containing the confidential information – which includes thousands of emails to and from the company – appears to have been inadvertently published on the front page of ACS:Law's website as it recovered from an attack, security experts Symantec told the Guardian. The file has since been distributed widely across the internet.

Andrew Crossley, the lead solicitor at ACS:Law who has shouldered much of the ire from compainants, this morning told the Guardian that he had contacted the information commissioner about the distribution of this confidential information, adding: "We're aware of it and unable to comment about it for legal reasons."

Asked about the attacks directed towards the company's website, Crossley said: "I'm not going to comment – we're still open for business, we're still open for trading."

The information commissioner said it would investigate how the data came to be made available. Separately, the campaign group Privacy International said it is planning to take legal action against ACS:Law for apparently breaching the Data Protection Act by allowing a sensitive archive of date to be hosted on a public-facing server.

Alexander Hanff, an advisor to Privacy International, said: "This data breach is likely to result in significant harm to tens of thousands of people in the form of fraud, identity theft and severe emotional distress. It has placed thousands of innocent people at risk."

A spokeswoman for the information commissioner's office said: "The ICO takes all breaches of the Data Protection Act very seriously. Any organisation processing personal data must ensure that it is kept safe and secure. This is an important principle of the Act. The ICO will be contacting ACS:Law to establish further facts of the case and to identify what action, if any, needs to be taken."

The methods used by ACS:Law for pursuing alleged file sharers have been criticised by consumer watchdogs and industry bodies including the British Phonographic Industry. Last month the firm was referred to a disciplinary tribunal after a long-running probe by the Solicitors Regulation Authority into its tactics in the pursuit of alleged file sharers. The company has been criticised for sending out thousands of letters to people it suspects of downloading illegal content, demanding payment of a fine to settle the case. Many who received the letters, which seem to have been based on the internet "IP address" – rather than the physical address – of the recipient have protested that they are innocent, and though hundreds of people are believed to have paid the fines claimed, the Guardian has not found any confirmed reports of any cases proceeding to trial, where ACS:Law's methods and evidence would have been tested.

The firm is believed to have been acting for DigiProtect, a German firm which works on behalf of rights-holders where it thinks their copyright has been infringed. ACS:Law appeared to be sending out letters demanding payment.

Jim Killock, executive director of the Open Rights Group, which champions internet users' rights, said: "Looking at the arguments in the emails, it's clear that IP addresses are unlikely to 'prove' copyright infringement and therefore avoid actual court cases."

Consumer watchdog Which? said it has so far received about 250 complaints from people contacted by ACS:Law, up from 150 complaints by the end of January.

The 365MB file containing the confidential information has been uploaded to file-sharing site The Pirate Bay. Earlier today, the UK Pirate Party urged the attackers to "find less drastic ways to make their displeasure felt", saying it opposed the leaking of confidential information. It did warn, however, that companies "tempted to adopt similar business models" to ACS:Law should reconsider, given the strength of feeling against them.

It said: "While the party believes in the importance of whistle-blowing and the necessity, on occasion, of otherwise confidential documents being published in the public interest, the party also attaches great importance on personal privacy.

"The data available may be of great interest to those following the firm's actions as it allegedly includes details of the processes they use, including concerns raised over the accuracy of their infringer-identification system. However it also contains the personal details of employees and clients of the firm, and some of those who have received 'threatening' letters from it along with other confidential information that is unlikely to be of public interest."

If the information commissioner determines that the cause of the leak was hacking, then the case would be turned over to the Interception of Communications Commissioner, as it would fall under the Regulation of Investigatory Powers Act.

Orla Cox, an internet security expert at Symantec, told the Guardian that those thought to be involved in the attack will feel they have "achieved their goal" this morning. "From a technical standpoint, this attack is nothing too adventurous – it's not like we haven't seen confidential information being exposed before," Cox said.

"What's interesting about this case is that a lot of the time [DDoS attacks are] usually quite stealthy but [these activists] have been quite open about it, openly advertising for people to join in. Usually, victims wouldn't necessarily realise the source but here people are volunteering. It's been going on for a few days and it doesn't look like they're giving up any time soon.

"It's always a concern when credit card numbers are involved, and identity theft is always a concern – there is a black market for it. So anyone who suspects their information is exposed might want to cancel their cards."

In the past week, activists have also launched DDoS attacks on US media firms, the Motion Picture Association of America and the Recording Industry Association of America.