Members of the Civil Service Sports Club, of which there are 130,000 nationwide, have been informed their names, addresses, dates of birth and National Insurance numbers have been stolen from a central computer database.
The details were then used in frauds aimed at obtaining money from the Government, the organisation has admitted.
The data breach is now the subject of an on-going criminal investigation and could be subject to court proceedings, it said.
Furious members of the club have only just been told their information was stolen, despite the fact it occurred in February 2010.
The breach could have affected senior members of the civil service, public sector workers across the country, and even retired employees who formerly used the leisure club.
One recipient said he was "absolutely livid" at the "blasé" letter, which he claimed was sent after the "holy grail of info" was lost.
Another, speculating on a social networking site, alleged: "That explains a bogus benefit claim in my name."
A third said: "A letter was waiting for me at home to tell me my details - my membership details including my name, address and national insurance number - had been stolen. I'm left fuming, as a lot of us are, that this has been going on for two years and this is the first I've heard of it."
In the general letter sent to members, the CSSC promised it was treating the matter "extremely seriously" and has taken "robust action".
It added it was "very sorry that this happened and for any anxiety which this letter may cause".
A spokesman for the PCS union, which represents civil servants, said: ""We're very concerned about what sports club members have been told and that it appears to have taken so long."
A spokesman for the CSSC said it had been "cooperating with the relevant authorities in a criminal investigation regarding the theft of some membership data".
"CSSC has been informed that some of this data was used for fraudulent purposes," he said. "CSSC has contacted members to tell them about the case and offer advice and assistance.
"As the issue is the subject of an on-going criminal investigation, CSSC is unable at this stage to provide any information concerning the facts of the case."
He added the organisation "takes data protection extremely seriously" and has enhanced its procedures for protecting membership records.
When asked why it had not informed its members in February 2010, as soon as the breach was identified, he said: "CSSC sought advice from the relevant authorities concerned with the criminal investigation and data protection as to whether it should inform its members.
"Following that advice, CSSC initially decided not to inform its members but kept the situation under regular review. Fresh information which has recently come to light has caused CSSC to revise that view."
The CSSC is a leisure and sports club which runs facilities, teams and events for members including a variety of sports from surfing to ten pin bowling.
It also arranges activities such as shopping days, spa days and "pudding clubs". Annual membership is £10.80.
