Phoenix Ireland has confirmed that it has lost a data tape containing the personal and bank account details of 62,000 customers and potential customers.
The company took over the Irish business of life assurance and pension company Scottish Provident two years ago.
The tape, which was not encrypted, is thought to have gone missing in July of last year, while in transit from one office to another.
However, the company says it is not certain that it has been mislaid outside of the company's premises.
It was initially thought that the data could not be accessed by a third party outside the company. But a subsequent analysis showed that there was a low risk of this.
As a precaution, customers have been sent a letter by the company alerting them that because the data was not encrypted, there is a risk that it could be accessed.
However, the company says that for this to happen, specialist equipment and IT knowledge would be needed, and the risk is therefore being classed as very low. It says that so far it has had no reports from customers of fraud or attempted fraud.
Both the Central Bank and the Data Protection Commission have confirmed that they were alerted in July of last year, in line with best practice.
However, the Data Protection Commission says it did not class it as data breach at the time because the company told it that the data was not accessible.
But a subsequent analysis over several months of an exact replica of the tape by a forensic expert revealed that with the right expertise and equipment the data, including names, addresses, bank account numbers and sort codes, could be accessed.
As a result, the commission reclassified the incident as a data breach in April. However, the commission says the risk is low to medium, and it is happy that the case has been handled appropriately by the company.