lawyer

The personal details of a further 8,000 people alleged to have shared music or films illegally have appeared online.

A list of more than 8,000 Sky broadband subscribers and a second of 400 PlusNet users surfaced following a security breach of legal firm ACS:Law.

It comes after a database of more than 5,000 people suspected of downloading adult films emerged on Monday.

The UK's Information Commissioner said ACS:Law could be fined up to half a million pounds for the breaches.

The two new lists, produced by ACS:Law, contain the names, addresses and Internet addresses (IP addresses) of users suspected of illegally sharing music.

In addition, they contain details of how much compensation infringers paid ACS:Law, along with internal case notes.

The BBC has also seen e-mails which contain credit card details of people who have paid the firm compensation. Others contain responses from people claiming their innocence.

One user whose name appeared on the list said he was "very angry" about the leak and believes "ACS should be shut down immediately, and that everyone on the list should be compensated".

I've never uploaded or downloaded pornography in my life Claire, Alleged file-sharer

He told BBC News that he was innocent of illegal file-sharing and had refused to pay the money demanded by ACS:Law.

The UK's Information Commissioner (ICO), speaking after the initial leak, told the BBC that ACS:Law had a number of questions to answer.

"The question we will be asking is how secure was this information and how it was so easily accessed from outside," said Christopher Graham.

"We'll be asking about the adequacy of encryption, the firewall, the training of staff and why that information was so public facing.

"The Information Commissioner has significant power to take action and I can levy fine of up to half a million pounds on companies that flout the [Data Protection Act]," he added.

Privacy expert Simon Davies called the leaks "one of the worst breaches" of the Data Protection Act (DPA) he had ever seen.

The documents appeared online after users of the notorious message board 4chan attacked ACS:Law's site in retaliation for its anti-piracy efforts, as part of what its users called Operation Payback.

Anti-piracy firms partner with music and film right's holders Firm uses software to track file-sharing sites and identifies the IP (internet protocol) addresses of the net connections used to share clients' content Armed with the list of IP addresses, ACS:Law can apply for a court order to obtain the physical address of suspected file-sharers from ISPs whose network has been used ACS:Law compiles its own lists cross-referencing the content that is alleged to have been shared with the personal details of ISP customers. Several of these lists were leaked A letter is sent to the alleged pirate, asking them to either pay a one-off fee of around ?300 per infringement or face court Many targeted by ACS:Law contend that IP addresses can be spoofed Others say that the IP address does not identify a PC, merely a connection, which could be shared between many people, hijacked or used without the owner's knowledge if not secured

ACS:Law has made a business out of sending thousands of letters to alleged net pirates, asking them to pay compensation of about ?500 per infringement or face court.

A BBC investigation in August found a number of people who said they were wrongly accused by ACS:Law of illegal file-sharing. The firm is under investigation by the Solicitors Regulation Authority (SRA) over its role in sending letters to alleged pirates.

The leaks consisted of about 1,000 confidential e-mails and attachments. It is thought documents may have also been acquired from the company's servers.

The collection was then uploaded to file sharing website The Pirate Bay, where it is being shared by hundreds of users.

The confidential messages include personal correspondence between Andrew Crossley - who runs ACS:Law - and work colleagues detailing a number of cases and how much money the firm had made from the letters.

Campaigners, who have long accused the firm of bullying tactics, have seized on the e-mails.

Speaking to BBC News, Mr Crossley said there were "legal issues" surrounding the leak.

"We were the subject of a criminal attack to our systems. The business has and remains intact and is continuing to trade," he added.

A web poster encouraging users to target Mr Crossley and his firm was posted on the 4Chan message boards

Mr Crossley said he would not comment directly on the contents of individual e-mails.

"All our evidence does is identify an internet connection that has been utilised to share copyright work," he told BBC News when pressed about the lists of personal data.

People can lodge a request with ACS:Law called a Subject Access Request, says privacy expert Simon Davies Results will disclose all personal information held on a person, including e-mails, memos, documents and files A person can ask for this information to be deleted if it is excessive, out of date, or wrong Removing details from the lists circulating on the internet is almost impossible, said Mr Davies, as there are so many copies in multiple locations

"In relation to the individual names, these are just the names and addresses of the account owner and we make no claims that they themselves were sharing the files," he added.

Mr Crossley said he had no further comment when asked why the Excel documents was unencrypted, but said he had notified the police, the ICO and was in communication with the SRA.

A spokesperson for Sky told BBC News that they were investigating the new leaks and said they were "very concerned at the apparent security breach".

"Like other broadband providers, Sky can be required by court order to disclose information about customers whose accounts are alleged to have been used for illegal downloading. We only ever provide such data in encrypted form."

Sky said they have "suspended all co-operation with ACS:Law with immediate effect" and that the suspension would "remain in place until ACS:Law demonstrates adequate measures to protect the security of personal information".

Mr Graham told BBC News that while he did not have the power to put ACS:Law "out of business" a large fine could have serious repercussions for the firm.

"I can't put ACS:Law out of business, but a company that is hit by a fine of up to half a million pounds suffers real reputation damage," he said.