Thousands of Morrisons staff personal details leaked online

The posting of Morrisons staff personal details online came only hours after Dalton Philips, the chief executive, boasted of new IT systems. Photograph: Christopher Thomond for the Guardian

The personal details of thousands of Morrisons staff including salaries, bank account details and addresses have been stolen and published online.

Police are investigating the serious security breach which occurred on Thursday night and is believed to have been the result of an internal leak, with data copied onto a portable storage device and taken out of Morrisons' Bradford headquarters.

A disc of the data, which has details of staff from director level to the shop floor, was also sent anonymously to a local paper in Yorkshire, the Telegraph & Argus, by a "concerned Morrisons shopper".

The leak appeared timed to cause maximum embarrassment to Morrisons in the wake of a massive profits warning on Thursday, which sent shares diving 12%. It also came hours after the chief executive, Dalton Philips, boasted that new IT systems would help to turn around Morrisons' performance.

Morrisons said that all the staff details published were put on an unspecified location on the web for a few hours and were taken down immediately when they were discovered. It said in a statement: "We can confirm there has been no loss of customer data and no colleague will be left financially disadvantaged." It is working with police to identify the source of the theft, which "initial inquiries" suggested was not the result of an external breach of its security systems.

It said it was now "urgently reviewing our internal data security measures," and was working with UK banks and credit check service Experian to help colleagues secure their bank accounts.

Morrisons said it had contacted staff via email and its Facebook page to inform them of the leak. It also set up an email address for questions. But some staff took to social media to express their anger and complain that they had not been informed.

One post on Facebook reads: "I've been at work for nine hours and nobody has told me – good communication M!"

Another staff member wrote: "Reading about this on Facebook does not inspire confidence, we should have been notified by phone by our HR departments first thing this morning."

Another post on Facebook reads: "Ironic that Dalton Phillips was on BBC Breakfast yesterday stating he'd updated the IT systems from the 1950s. Those systems were probably too old to be hackable!"

Another post appeared to threaten action against those complaining about the leak: "This is further bad publicity for our company at a difficult time, and I'd like to ask all of my fellow colleagues to think carefully about what they say in the public domain and the effect it could have on our reputation."

The leak is the latest embarrassing issue for Morrisons, just weeks after the supermarket group's treasurer and head of tax, Paul Coyle, was arrested and questioned over alleged insider dealing relating to trading in the shares of Ocado, Morrisons' partner for its new online grocery-delivery service.