Politicians have called for an inquiry into how more than 1,000 prominent figures who are to receive honours had their home and work addresses posted on a government website.

Personal details of those on the new year honours list – including more than a dozen MoD employees and senior counter-terrorism officers – were published in a downloadable list at 10.30pm on Friday. The Cabinet Office said the document was visible on its website for around an hour.

Sir Bob Kerslake, who was head of the civil service between 2012 and 2014 and is a crossbench peer, led calls for an urgent investigation.

“It is a serious and indeed extraordinary breach because this is a well-established process that has gone on in pretty much the same way for years, so I think an urgent investigation is certainly needed,” he told BBC Breakfast on Sunday.

“Of course, it’s likely to be human error, as has been suggested, but we need to know how well staff were trained about the importance of maintaining security. Were they briefed on the potential consequences if this information was released?”

Kerslake added: “There are significant consequences here and we need to get to the bottom of this as quickly as possible.” He said it would be premature for Mark Sedwill, the cabinet secretary and head of the civil service, to resign over the leak as what was first needed was “a much better understanding of why it happened”.

Diana Johnson, Labour MP for Kingston upon Hull North, who is to be made a dame, said she fully supported Kerslake’s call for an inquiry. “We all share the concerns about breaches of security concerning home addresses and other personal details, particularly for serving police officers and counter-terrorism officers,” she said.

“As an MP, I am only too well aware of the importance of keeping individuals’ personal information safe and secure after the dreadful events of recent years.”

There is considerable anger within Whitehall about the leak, with insiders acknowledging it was highly embarrassing and there could be national security implications, given that some senior police officers were on the list.

Of particular concern was the possibility that hostile states – such as Russia or China – would have obtained the sensitive information and could use it to their advantage.

The initial signs in Whitehall were that any internal inquiry would be limited to the Cabinet Office. Insiders agreed that the leak was almost certainly the result of “human error” – with no evidence of any kind of cyber-attack, for instance – and that as a result there would be no need for a wider inquiry unless political pressure demanded it.

The Cabinet Office said it had reported the matter to the Information Commissioner’s Office (ICO) and added it was contacting affected individuals in order to provide advice and guidance should they have any security concerns, as well as to apologise for the error. It said it couldn’t comment on security advice to individuals but added it was working to ensure that any potential risks to personnel were minimised.

The ICO, which has the power to impose large fines on organisations for data breaches, said it was investigating. Since the introduction of general data protection regulation (GDPR) rules in May 2018, the ICO has been able to issue penalties equivalent to 4% of a company’s annual global turnover or £17m, whichever is greater.

The former work and pensions secretary Iain Duncan Smith, who is to receive a knighthood and whose address was published, told the Sunday Times that the breach was a “complete disaster”.

“Ministers need to be asking some very serious questions of those involved about how this was allowed to happen and why no final checks were carried out before the document was published,” he said.

“Everybody knows virtually everything about me. It’s much more concerning for private citizens, like those who have been involved in policing or counter-terrorism or other such sensitive cases, to have their addresses published.”

The Hackney councillor and charity worker Mete Coban, who was awarded an MBE for services to young people, seemed less concerned, telling the news agency PA Media: “If those responsible have apologised and it is a genuine error, then there is not much more that can be done.

“I understand why others are concerned, but most of my details are online because of the council work anyway. It is not ideal, but what is done is done.”

Prominent public figures who had their home addresses published included the musician Elton John, the cricketer Ben Stokes, NHS England’s chief executive, Simon Stevens, the TV chef Nadiya Hussain, and the former director of public prosecutions Alison Saunders.

A petition condemning the decision to award Duncan Smith a knighthood, saying he had been responsible for some of “the cruellest most extreme welfare reforms this country has ever seen”, had received 140,000 signatures by Sunday afternoon.

“The suffering and impoverishment which are a direct result of the welfare reforms he has implemented are now undeniable,” said the petition’s creator.

A member of the public contacted the Guardian after downloading the spreadsheet from the government website page where the 2020 new year honours list was posted and noticing that addresses were included.

“I couldn’t quite believe my eyes at first,” she said. “I thought maybe that’s just what they do. But then I checked past spreadsheets and saw there was nothing on those and I realised this must have been a catastrophic mistake.”



