To be fair, people didn't withdraw funds, someone was able to set up a recurring transfer (direct debit) from his account to a charity. Which makes it useless for theft, since the thief would leave definite proof of their identity (receiving account number).

The best part, I think, is Clarkson's response:

Clarkson now says of the case: "Contrary to what I said at the time, we must go after the idiots who lost the [personal information] and stick cocktail sticks in their eyes until they beg for mercy."