Survivors of abuse by Mohamed Al Fayed have called on Prime Minister Andy Burnham to intervene after they “lost faith” in the Metropolitan Police’s investigation.

The Met accidentally shared the email addresses of more than 140 people who reported being victims of the billionaire Harrods owner.

The force failed to hide recipients’ email addresses when it sent out a monthly update to victims on Tuesday last week, leaving them visible to others on the distribution list.

The Met apologised for the data breach on Saturday, describing it as “human error”.

A Home Office spokesperson said the Independent Office for Police Conduct (IOPC) is investigating the Met’s handling of Al Fayed allegations and the force has made a referral to the Information Commissioner’s Office, and that the Government “must let these investigations run their course”.

An advocacy group for survivors of Al Fayed, called No One Above, urged the Government to act, saying the Met had “failed to keep survivors safe”.

No One Above said in a statement: “The investigation has inflicted two egregious data breaches on the survivors it exists to protect, delayed answering their questions and dismissed their calls for proper safeguarding of witnesses and evidence.

“We have lost faith in Operation Cornpoppy. The latest safeguarding failure, exposing the identities of 147 victims, is the culmination of a multi-decade history of failure.

“The state cannot use the principle of non-interference in police investigations as a shield for its responsibilities to victims and the public.

“No One Above calls on the Burnham Government to show the resolve its predecessors lacked.

“Prove now that the safety of women and girls matters, deliver justice to Fayed victims and end impunity for those who believe themselves above British law.”

The group has called for the National Crime Agency (NCA) to take the lead on the investigation, saying it is better able to be independent, and to bring in the “financial and international capabilities a serious organised crime case demands”.

The survivors also called for confirmation that the investigation “pursues modern slavery lines of inquiry as a primary focus” and parliamentary scrutiny of the investigation.

The group’s fourth request is for a full IOPC investigation into past and ongoing Met failures, rather than the current model of IOPC-directed investigations by the Met itself.

The survivors are also requesting a safeguarding risk assessment, which includes conflicts of interests threatening the integrity of evidence and access to vulnerable witnesses.

Finally, the survivors are asking for a statutory public inquiry to “dismantle the institutional architecture of impunity in Britain spanning the litany of failures to hold powerful sex criminals to account”.

The survivors expressed deep concern about the data breach, adding that the leak to the press had drawn “fresh attention to people whose safety should have been prioritised and increasing risk to those individuals”.

No One Above said: “The risk to survivors is real,” adding that their email addresses being exposed leaves them vulnerable to “phishing, impersonation, identity theft and targeting” and that the public reporting “only sharpens the need to act”.

It is understood that the breach affects all victims who have opted to receive updates on the investigation, but recipients were split into smaller groups, so email addresses were visible to recipient groups, rather than the whole cohort.

The Met said the data breach was being investigated “as a matter of priority”.

A spokesperson said: “On Tuesday 11 August, officers issued a monthly update to victims regarding progress in our investigation into those who may have facilitated Mohamed Al Fayed’s offending.

“The update was to confirm a further three suspects, one aged in their 70s and two in their 80s, have recently been interviewed under caution, bringing the total number interviewed under caution as part of the investigation to seven. Inquiries remain ongoing.

“Due to human error, recipients’ email addresses were visible to others on the distribution list.

“The issue was identified quickly and immediate action was taken.

“We understand the impact this may have on victims and sincerely apologise. Everyone affected was contacted directly on the day of the incident.

“The incident is being investigated as a matter of priority, and we are reviewing our processes to help prevent a similar breach from happening again.”

It is understood that the Information Commissioner’s Office (ICO) has been notified and the incident has been formally recorded in the investigation records.

The latest breach came days after the Met was reprimanded by the ICO on August 5 for data protection failures, including disclosing a victim’s new contact details to their alleged stalker.

According to the ICO, the Met’s mitigation steps included introducing “a new behavioural alert tool designed to prompt staff when emails are being sent to multiple external recipients”, but days later the data breach regarding the Al Fayed victims took place.

No One Above has asked the Met to confirm what it is doing to contain the data breach, offer identity-theft and dark-web monitoring to everyone whose details were exposed, and to “put survivors’ safety first”.

It is understood that the investigation team is reviewing alternative methods to issue updates to the victim cohort to protect against human error.

The impact of the breach will continue to be monitored and any emerging risks will be reviewed, with safeguards and support considered where justified by the assessed level of risk.

A Home Office spokesperson said: “Our heartfelt condolences go out to all those affected by this distressing case, we recognise the challenges they have faced, including in their pursuit of justice.

“The Independent Office for Police Conduct is investigating complaints about the Metropolitan Police’s handling of Al Fayed allegations, and the force has made a referral to the Information Commissioner’s Office. We must let these investigations run their course.

“We are deploying the full power of the state to deliver the largest ever crackdown on violence against women and girls in British history, and remain relentless in our pursuit to halve it in a decade.”

The Met is also accused of failing in its legal duty to Al Fayed victims in relation to the national referral mechanism (NRM).

The NRM is the UK’s official framework for identifying victims of modern slavery, and certain public bodies, including the police, have a legal obligation to refer all children and consenting adults they have reasonable grounds to believe may be a victim.

All four No One Above members, who have been recognised by the Home Office as victims of modern slavery, told the Press Association the Met did not offer them a referral when they came forward.

Instead, they self-initiated referrals through an anti-slavery charity called Unseen and received their positive conclusive grounds decisions in recent months.

It it understood the Met believes there is no automatic requirement for them to submit a referral for offences that occurred before the implementation of the NRM in April 2009 and the Modern Slavery Act 2015, but the Home Office views the historical nature of the alleged exploitation as irrelevant for referral purposes.

More than 400 allegations of sexual misconduct have been made against Al Fayed, dating between 1977 and 2014, including sexual assault, rape, sexual exploitation and human trafficking.

The Met are dealing with at least 156 victims who contacted them directly, including 21 who came forward before Al Fayed’s death in 2023 at the age of 94.

The investigation, known as Operation Cornpoppy, was launched in November 2024 and is looking at people who may have facilitated or enabled Al Fayed’s crimes

Seven people have been questioned under caution: four women in their 40s, 50s, 60s and 80s, and three men in their 60s, 70s and 80s.