Royal Cornwall Hospitals NHS Trust review highlights impact of data breach - SC Media
The Royal Cornwall Hospitals NHS Trust inadvertently published an Excel workbook containing sensitive sickness absence records for 8,003 individuals in February 2023, with exposure discovered in November 2025.
National Health Service staff faced significant emotional distress while managing a helpline established after the major data breach. The breach occurred when the trust inadvertently published an Excel workbook in response to a Freedom of Information request, which contained hidden pivot tables revealing sensitive sickness absence records.
Breach details
A member of the public discovered the exposure in November 2025. The subsequent helpline, staffed by clinical governance employees with minimal training, operated for 11 weeks. Handlers reported managing calls from distressed individuals, including those concerned about domestic safety, while simultaneously discovering their own data had been compromised.
Corrective measures
The trust has issued a formal apology to those affected.
The incident stemmed from procedural failures, including the use of an incorrect department to process the request and the omission of mandatory data sanitization steps like converting files to CSV. The trust has since implemented stricter approval processes, requiring senior information governance oversight for spreadsheet disclosures.
Related
