The UK's data protection watchdog has launched an investigation into the tax credit fraud fiasco that resulted from the theft of the identities and personal details of almost 13,000 staff at the Department for Work and Pensions (DWP) and Network Rail.

The government admitted last week that 8,800 staff identities at the DWP had been stolen in 2003/04, with 6,800 used in attempts by criminal gangs to make false tax credits claims last summer. Meanwhile 4,000 Network rail staff had personal details stolen and used by fraudsters to exploit security weaknesses on the tax credits claim website.

Although HM Revenue and Customs (HMRC) claims to have stopped many of the fraudulent claims before any money was paid, it admits to losing £2.7m from those that slipped through the net. The tax credits website was closed down in December and is still offline while the criminal investigation is ongoing.

Data protection watchdog the Information Commissioner's Office (ICO) is now investigating how the personal details of thousands of government workers and Network Rail staff ended up in the hands of criminals.

HMRC executive director David Varney told MPs before Christmas that he believed criminals had somehow obtained staff payroll records from the DWP.

A spokesman for the ICO confirmed to silicon.com that 45 complaints about personal information of DWP employees being stolen have been received.

The spokesman said: "The ICO takes breaches of people's privacy very seriously and we have already contacted both HMRC and the DWP. Our investigation is ongoing."