Barclays Plc, the U.K.’s second-largest bank by assets, is speaking with regulators, customers and British authorities about a possible criminal leak of client account information.

A Barclays probe into the leak suggests the data is from 2008 or earlier and is linked to a financial-planning unit that was shut in 2011, Carey Withey, a company spokeswoman, said in an emailed statement. London-based Barclays is taking “all necessary steps” to contact the clients affected, she said.

As many as 27,000 customer files containing personal and financial information were taken, the Mail on Sunday reported Sunday, citing an unidentified whistle-blower. It’s unclear how the files were stolen, the newspaper said, adding data was sold to brokers to be used for “investment scams.” 

The information include details of income, savings, mortgages, health issues, insurance policies as well as passport and national insurance numbers, the Mail on Sunday said. The newspaper said the whistle-blower had given it a memory stick containing files on 2,000 customers and had told it that each of the 27,000 files could be sold for as much as 50 pounds ($82).

The Mail on Sunday said each file was about 20 pages long and the customers included doctors, business executives, scientists, a musician and a cleaner. The newspaper said the whistle-blower first became aware of the files in September, when a brokerage firm asked him to sell them to other traders.

“We are grateful to the Mail on Sunday for bringing this to our attention and we contacted the Information Commission and other regulators on Friday as soon as we were made aware,” Withey said. “This appears to be criminal action and we will cooperate with the authorities on pursuing the perpetrator.”

The U.K.’s Financial Conduct Authority said it will work with Barclays “to understand exactly what has happened and what steps consumers may need to take,” Lara Joseph, a spokeswoman for the regulator, wrote in an email.

“It’s crucial that people’s personal information is properly looked after,” the U.K. Information Commissioner’s Office said in an emailed statement. “We’ll be working with the Mail on Sunday this week to get further details of what has happened here, as well as working with the police.”

A spokesman for the City of London Corporation, which administers the capital’s business district, didn’t immediately return a call and email request for comment outside normal business hours.

The leak’s disclosure comes less than a week after Chief Executive Officer Antony Jenkins turned down his 2013 bonus, acknowledging that regulatory penalties and lawsuits have continued to impose costs on the bank. Regulators are investigating Barclays for possible manipulation of foreign-exchange markets, and the bank is reviewing its trading over a “several-year” period, the company said in October. (Bloomberg)