A major British bank is investigating the possible theft and sale of customers’ personal data. At least 2,000 Barclays customers might be affected.

Initial reports indicate that the breach was limited to customers of the bank’s financial planning branch, which was closed in 2011, according to The New York Times. The leaked personal data seems to be from 2008 and earlier.

A whistleblower exposed the leak by providing a UK newspaper with a thumb drive containing the files. Personal information on income, savings, mortgages, health issues, insurance policies and passport and national insurance numbers were included in the data. More than 20,000 files were acquired and could be sold for about $82 each.

The anonymous whistleblower has known about the breach since September.