NHS data breach exposed sensitive staff health records for nearly three years

What was taken

A spreadsheet published by Royal Cornwall Hospitals NHS Trust in response to a Freedom of Information request exposed sensitive sickness absence and health data. The breach affected 8,003 people: 7,715 trust staff, 288 non-trust workers, and a small number of unidentified individuals. The data included details that could reveal personal health information, which is considered highly sensitive under UK law. The spreadsheet was available online for 33 months before the trust was alerted to the issue, and logs show it was accessed at least 340 times in the last year, though it is unclear how many people actually viewed the sensitive data or if web crawlers inflated the count [The Register↗ (opens in a new tab)].

How the flaw works

The breach happened because an Excel workbook published online still contained underlying data in its pivot tables. Pivot tables are a feature in Excel that summarise large datasets, but they can also retain hidden data that users might not see at first glance. In this case, the trust believed they had removed sensitive information, but the data could still be accessed through the pivot table. The team responsible for responding to the Freedom of Information request skipped some standard checks, such as using Excel's Document Inspector to flag hidden data and converting the file to a safer format like PDF or CSV. The sign-off process also failed to catch the error, focusing more on public relations than data security [The Register↗ (opens in a new tab)].

The response

When the breach was discovered in November 2025, the trust set up a helpline for affected staff. Many call handlers only learned their own data was exposed while working on the helpline. Staff described taking difficult calls from distressed colleagues, including people worried about domestic abuse risks. The helpline team was given just a day's notice and little training, and had to make safeguarding decisions without clear guidance. The helpline was meant to run for two weeks but stayed open for 11 due to high call volumes. Staff worked long hours and reported significant emotional strain. The trust has since changed its procedures: Excel files must now be password-protected, a senior information governance officer must approve responses, and guidance now calls for converting spreadsheets to CSV to strip hidden data. The Information Commissioner's Office closed its case after the trust made these changes [The Register↗ (opens in a new tab)].

What you should do

For organisations handling sensitive data, always check files for hidden information before publishing. Use tools like Document Inspector in Excel, and consider converting files to formats that cannot store hidden data, such as CSV or PDF. Ensure staff are trained and supported when responding to breaches, especially when dealing with distressed individuals. Regularly review and update procedures for handling data requests to prevent similar incidents.