Sensitive personal information about more than 1,000 children has been published on the UK Independent Schools Guide website after an alleged cyber attack.
The information was contained in a database of applications for top independent schools held by Gabbitas, which advises parents on applications and publishes the Independent Schools Guide.
The website was shut down after the paper alerted Prospects Services, the outsourcing company that owns Gabbitas.
It claimed the database was publicly available only because of a cyber attack, but said the website had been secured and police would be asked to investigate.
UK privacy watchdog the Information Commissioner's Office (ICO) is also to open an investigation. "We will be making inquiries into the circumstances of any potential breach of the Data Protection Act before deciding what action, if any, needs to be taken," an ICO spokesman said.
The ICO has the power to issue penalties of up to £500,000 for serious data breaches, and two of the biggest penalties issued so far have involved the personal data of children.
In December 2011, the ICO imposed a penalty of £130,000 on the Powys County Council and £140,000 on the Midlothian Council the following month for sending sensitive personal data about children to the wrong people.