Marks & Spencer has confirmed that a laptop containing the personal details of 26,000 employees has been stolen.
The laptop had been given to a printing company to allow it to write to the employees about pension changes.
The data stored on the device included salaries, addresses, dates of birth, National Insurance details and phone numbers.
Two days after the theft, M&S wrote to all staff whose names were on the laptop warning them of the risk and offering free credit checks.
Jamie Cowper, European marketing director at email and data encryption firm PGP, said that the panic could have been avoided if the data on the laptop had been encrypted.
"Companies need to realise this before legislation in this area drives greater punishment," he said.
"Laptops will continue to go missing, but whether they are lost or stolen is irrelevant as long as the data is protected only by a simple password that is easily compromised in the wrong hands."
Cowper warned that the rash of recent thefts can be disastrous for a company's image, as staff and customers are increasingly concerned about the possibility of identity theft.
"M&S has joined a long list including the Royal Cornwall Hospital Trust, Nationwide Building Society, the Metropolitan Police and many others," said Cowper.
"The only silver lining here, as in most of these cases, is that it seems to have been an opportunistic theft rather than a targeted attack."
