A magistrates court's computer server containing hundreds of thousands of files with sensitive personal information including details of witnesses and victims was put up for sale on eBay.
The Information Commissioner's Office has been investigating the security breach after being alerted to the theft of the device from Salford Magistrates Court in June 2012.
It declined to comment on the progress of the inquiry.
None of the people whose details were included in the 400,000 files have been notified. Justice Minister Helen Grant confirmed the blunder in an answer to a written parliamentary question by Labour's Andy Slaughter after details emerged in the Ministry of Justice's annual report.
Mrs Grant said that the £1,200 server had been returned but a police investigation found insufficient evidence to identify who had stolen it and no charges were brought.
Mr Slaughter criticised the way the investigation had been handled. He said the stolen details "could put victims and witnesses in criminal trials at risk".