
"They specifically targeted the data on the servers," said John Fellows, company secretary for First Response Finance.
"There was an element of data encryption so the data isn't wide open but we decided to let everyone who could be affected know. Most of the phone calls we're taken from people who received the letters have been very supportive."
Although the company was under no legal obligation to do so it sent out the warning because of the targeted nature of the attack, has posted details of the attack on its website and included a comprehensive Q&A and a telephone support line.
"First Response is now the latest UK organisation to take the appropriate action and inform its customers immediately of a security breach. And while we should applaud this voluntary disclosure, it is yet another stark reminder that organisations need to completely rethink their current data protection strategies and prepare for the worst-case scenario," said Jamie Cowper, director of European marketing at data encryption expert PGP Corporation.
"While First Response states that its customer information was held and properly secured under the terms of the Data Protection Act, as this incident shows – this was shown to be not enough. The sophistication and determination of data thieves today – both targeted and opportunistic – have turned the traditional notion of data protection on its head."
Greater Manchester police are conducting an investigation into the theft and the company is cooperating fully.