The identities of more than four million Britons are being offered for sale on the internet, The Times has learnt.

Highly sensitive financial information, including credit card details, bank account numbers, telephone numbers and even PINs are available to the highest bidder.

At least a quarter of a million British bank and credit card accounts have been hacked into by cybercriminals, exposing consumers to huge financial losses. Most of the personal data has been gathered as a result of “phishing” — a process whereby members of the public are duped into handing over their key details, such as user names, passwords and credit card details.

Unsuspecting victims hand over the information by e-mail to people posing as reputable sources such as banks or online stores. Other data has been stolen after criminals infect a person’s personal computer with viruses and then raid it for information.

They are then sold to the highest bidder on online forums or hacking websites. Individual credit card details have been sold for as little as 30p. The Times has also learnt that the communications and e-mail systems of some of Britain’s biggest public bodies and private companies are open to possible attacks. This is because the corporate e-mails and passwords have been sold to cybercriminals. The details of policemen, doctors and military personnel are also at risk.

The information being traded on the web has been intercepted by a British company and collated into a single database for the first time. The Lucid Intelligence database contains the records of four million Britons, and 40 million people worldwide, mostly Americans. Security experts described the database as the largest of its kind in the world.

The database, which has been seen by The Times, raises important data protection concerns. The Information Commissioner, the data protection watchdog, is monitoring the development of the database. Police in London have also been informed but no action has been taken.

The database is held by Colin Holder, a retired senior Metropolitan police officer, who served on the fraud squad. He has collected the information over the past four years. His sources include law enforcement from around the world, such as British police and the FBI, anti-phishing and hacking campaigners and members of the public. Mr Holder said he had invested £160,000 in the venture so far. He plans to offset the cost by charging members of the public for access to his database to check whether their data security has been breached.

The legality of the database could be put to the test in the coming week. The Information Commissioner’s Office said it could not endorse a commercial service or make a ruling on its validity unless someone made a complaint. But the privacy watchdog said it had “provided advice to help the company comply with the principles of the Data Protection Act”.

A police source, who did not wish to be named, said that he had seen Mr Holder’s information as he passed it on to the relevant authorities, and “it could only have come from phishing or hacking”.

“I’m concerned, but I’m not surprised in the least,” said Mikko Hyppönen, chief research officer at F-Secure, the computer security experts. “We’ve seen this going on for quite a while. There’s a mind-boggling amount of information that’s being sold on the underground forums.”

One man from Clapham whose details are on the database, but who cannot be named for legal reasons, said: “I was appalled to discover personal information about me was being traded. Financial services companies should be more aggressive in pursuing the fraudsters instead of passing on the cost in bank charges.”

Most of the records in the database are considered at “low risk” of identity fraud. However, even big collections of e-mail addresses are useful for those wanting to inundate people with huge amounts of “spam” messages.

Among the places vulnerable to security breaches are banks, financial institutions including the Bank of England and Companies House and multinational defence companies.

All organisations where employees’ e-mails have appeared on the database have been contacted.