My bank recently wrote to me to apologise for sending a letter to my wifes ex-husband giving details of new mortgage repayments. He no longer lives at the address they hold for him. But someone out there now knows how much I pay!
Probably, yes (makes a change, most of the time when people think the DPA has been breached it doesn't even apply) in this case it would seem to be covered by
"Appropriate security measures must be taken against unlawful or unauthorised processing of personal data and against accidental loss of, or damage to, personal data."
But they have apologised, and presumably rectified whatever error caused it to happen, so what more do you want?