Millions of customers of a Russian mobile phone operator may have had all their credit card details, addresses and social security numbers stolen.

Mobile Telesystems (MTS) has admitted what could be one of the largest data thefts in history.

According to the New York Times, victims' stolen details were found on CDs circulating on the streets of Moscow. The CDs were said to contain details of as many as five million customers.

A company spokesman explained that the theft was discovered a few weeks ago but that the company was still struggling to determine where the leak came from.

Analysts have suggested that the breach may not have occurred at the company but at a government agency. Mobile phone operators have to hand over information about their customers to the police and government agencies, and there has been some speculation that a low-paid employee at one such agency may have sold the data.

MTS acknowledged that the leak could have come from either inside the company or outside but told the US newspaper that it found it "very difficult to imagine that it came from inside".

The spokesman could not say whether the pirated CDs held the company's whole customer roster, or whether credit card data was included.

The phone company has begun offering new personal identification numbers to customers to head off any abuse of their mobile phone numbers.