The account details of 75,000 HBOS customers were accidentally disclosed to a woman in Aberdeen after the bank mailed five packages, each containing 15,000 sets of account details, to her home address.
Stephanie McLaughlan, 22, told the BBC: "These packages were just dumped on my doorstep one day."
She has accused the bank of "terrible negligence", commenting: "The bank did not have a clue they had left them in my house or their contents."
HBOS has launched an investigation to determine the source of the error.
"This is a very specific, isolated incident," the bank's statement stressed, continuing: "We will take steps to ensure there is no security issue for customers as a result of this matter."
"It would appear that HBOS has been negligent with bank statements which contain important personal information about their customers," Ken Macdonald, assistant commissioner to the Information Commissioner's Office (ICO) in Scotland, told BBC News.
"Clearly, where personal information is not processed and stored securely, there is a risk that it can fall into the hands of criminals," he added.
Mr Macdonald confirmed that the ICO would contact HBOS about the disclosure.For more information about online banking, click here.
© Adfero Ltd