The Conservative party chairman responsible for overseeing conference has refused to confirm whether or not he would be resigning from his role after a major security flaw in the conference app exposed the private data of cabinet ministers.

Anger was directed towards Brandon Lewis in the immediate aftermath of the security breach as senior party figures poured scorn on the chairman’s credentials.

One senior Tory said: “Brandon Lewis is telling everyone who will listen that he could be the man to run the country – yet this conference fiasco shows he couldn’t run a bath.”

In an interview on Sunday morning, Lewis recognised the seriousness of the incident and said his focus was ensuring conference went smoothly.

“Any breach of data is a serious matter and that’s why we are taking it seriously,” Lewis told Sky News. “We are investigating, and we have already contacted the information commissioner, and will be putting in a fuller report to them.

“We’ve spoken to the company that supplied it, who themselves have put out a statement apologising for the error that they made.”

Neither Lewis nor the app provider was able to reveal the extent of the mishap and the MP for Great Yarmouth speculated that “it will be a limited number of our delegates”.

“This will affect people where somebody has guessed or already known somebody’s email address and was therefore able to log in as them,” he said.

“So, it will be a limited number of our delegates here and we are contacting the delegates to outline to them what has happened and what they can do about that.”

Asked whether he considered resigning over the “fiasco”, Lewis said: “At the moment I’m focused on making sure that conference goes well.”

The Scottish Conservative leader, Ruth Davidson, said the episode was embarrassing for the party.

“I think there was an issue there but it was resolved very quickly,” she told Sky News. “Of course the party is going through all the appropriate inspections and remedies that are there.

“It is embarrassing, there’s no getting away from that, but it was identified early, it was fixed quickly and then we move on.”

In order to attend Conservative party conference, hundreds of people were required to consent for their personal data to be shared with a third party, CrowdComms Ltd, which developed the Conservative Party Conference 2018 event app that many guests appeared to have no option but to agree to “utilise”.

The registration form for attending the conference stated: “Your data will only be shared for this purpose and will not be given to any other third party.”

The app has a list of speakers; however, many of those listed – including journalists, dignitaries and businesspeople – do not appear to be speaking at the conference. This list remained visible on Sunday, although the app is now functioning securely.

The data of attendees could be accessed by guessing email addresses, with that of Boris Johnson, Michael Gove, Gavin Williamson and others among those whose personal information – including their phone numbers – was potentially viewable.

Cabinet ministers were reported to have received prank calls, while others, including Johnson, appeared to have their details changed. Twitter users claimed the former foreign secretary’s picture had been briefly changed to one featuring a pornographic image.

Attendees received an email from the party on Sunday, which said it was taking the incident “very seriously”.

“It’s not good enough that people’s data may have been made available and we are disappointed that we have been let down by a third party supplier,” the email read.

In a statement, CrowdComms said: “An error meant that a third party in possession of a conference attendee’s email address was able, without further authentication, to potentially see data which the attendee had not wished to share – name, email address, phone number, job title and photo.

“We apologise unreservedly to the Conservative party and their delegates.”

The Information Commissioner’s Office said it would be making inquiries with the Conservative party – which had already made an initial data breach report to the public body – and that organisations had a legal duty to keep personal data safe and secure.