In a letter to members, Simon Lee, chief executive of the CSSC, said that at the time it was believed that only a small numbers of records were affected, and it did not notify members because “there was no evidence of any risk to individuals”.
He added that subsequent investigations have revealed that the full membership database could have been stolen.
A criminal investigation into the fraudulent use of the information is now in process. New members who joined CSSC after 1 March 2010 are not affected.