The legacy body said it mistakenly disclosed the names — principally of individuals who were requesting investigations — to a single recipient who had previously sought assistance from ICRIR.

The breach on Tuesday 18 March 2025 was caused by “an administrative error in an email address field” and was discovered “within several hours”.

No sensitive or special category information was disclosed, and the recipient confirmed that they had deleted the information.

The people affected were contacted “with a sincere apology and offer of further advice or support”.

In a statement yesterday, ICRIR said: “The Commission takes very seriously its responsibilities in protecting the privacy of individuals and the security of information entrusted to us.

“The Commission is very sorry for this error.

“An internal investigation is now underway, and a full report has been sent to the Information Commissioner’s Office.”