There is nothing at this stage to suggest that the discs have been mis-used but I can appreciate that folk are more than a wee bit concerned. Anyway, this is what it says on the HMRC website,
"What happens if data about my family is misused anyway?
You should contact the organisation where the fraud has taken place.
As is usual in these circumstances, if you are the innocent victim of banking fraud you will not have to pay.
If, as a direct result of this incident, you incur costs we will consider compensating them."