Royal Cornwall Hospitals NHS Trust review: FOI spreadsheet exposed sickness absence data of 8,003 staff for 33 months
An independent review into the Royal Cornwall Hospitals NHS Trust data breach found that staff drafted into the victim-support helpline faced distressed and angry callers, safeguarding decisions and a "serious emotional impact" without training or support. The breach involved an Excel workbook published to the trust's public FOI Disclosure log in February 2023, which retained underlying sickness absence records accessible through its pivot tables, exposing sensitive health data on 7,715 trust staff, 288 non-trust workers and a small number of unidentified records — 8,003 people in total. A member of the public discovered the exposure in November 2025, after the file had been publicly available for 33 months; access logs covering only the final 12 months showed 340 accesses, with no way to tell how many were human or reached the pivot tables. The helpline, planned for two weeks in December 2025, ran for 11 weeks until February 2026 because of call volume; most call handlers learned their own data was exposed while already supporting others. The Information Commissioner's Office closed its case after the trust implemented the review's recommendations. This is an accidental data exposure, not an intrusion or exploited vulnerability — no threat actor, malware or CVE is involved.
Detalhes técnicos
The FOI request, believed to come from a journalist researching NHS stress, was handled by the trust's e-Rostering team rather than the People Information Unit, which held the expertise for complex datasets. The team believed it had stripped the sensitive data, but the workbook was published in a format preserving the pivot table cache. Several standard steps were skipped: an FOI officer either did not run Excel's Document Inspector or did not act on its findings — the tool can flag pivot tables and cached data but cannot judge sensitivity or remove the cache — and staff did not convert the file to PDF, which investigators found would have blocked click-through to the underlying records. Internal guidance at the time did not require CSV conversion, which would have removed the pivot-table functionality and embedded cache. Sign-off focused on answering the request and on public relations duties, wrongly assuming the data had already been sanitized.
Remediação
The trust now mandates password protection of any Excel workbook released under FOIA and requires approval by a senior information governance officer before executive sign-off of spreadsheet responses. Revised guidance circulated in November 2025 calls for conversion to CSV, but investigators found this had not been written into the formal standard operating procedure and recommended updating it. The full independent report has been published on the trust's website and circulated to staff, and support continues for affected colleagues.
Linha do tempo
-
Royal Cornwall Hospitals NHS Trust review: FOI spreadsheet exposed sickness absence data of 8,003 staff for 33 months
ler a análise desta fonte ocultar
An independent review into the Royal Cornwall Hospitals NHS Trust data breach found that staff drafted into the victim-support helpline faced distressed and angry callers, safeguarding decisions and a "serious emotional impact" without training or support. The breach involved an Excel workbook published to the trust's public FOI Disclosure log in February 2023, which retained underlying sickness absence records accessible through its pivot tables, exposing sensitive health data on 7,715 trust staff, 288 non-trust workers and a small number of unidentified records — 8,003 people in total. A member of the public discovered the exposure in November 2025, after the file had been publicly available for 33 months; access logs covering only the final 12 months showed 340 accesses, with no way to tell how many were human or reached the pivot tables. The helpline, planned for two weeks in December 2025, ran for 11 weeks until February 2026 because of call volume; most call handlers learned their own data was exposed while already supporting others. The Information Commissioner's Office closed its case after the trust implemented the review's recommendations. This is an accidental data exposure, not an intrusion or exploited vulnerability — no threat actor, malware or CVE is involved.
Technical Details
The FOI request, believed to come from a journalist researching NHS stress, was handled by the trust's e-Rostering team rather than the People Information Unit, which held the expertise for complex datasets. The team believed it had stripped the sensitive data, but the workbook was published in a format preserving the pivot table cache. Several standard steps were skipped: an FOI officer either did not run Excel's Document Inspector or did not act on its findings — the tool can flag pivot tables and cached data but cannot judge sensitivity or remove the cache — and staff did not convert the file to PDF, which investigators found would have blocked click-through to the underlying records. Internal guidance at the time did not require CSV conversion, which would have removed the pivot-table functionality and embedded cache. Sign-off focused on answering the request and on public relations duties, wrongly assuming the data had already been sanitized.
Remediation
The trust now mandates password protection of any Excel workbook released under FOIA and requires approval by a senior information governance officer before executive sign-off of spreadsheet responses. Revised guidance circulated in November 2025 calls for conversion to CSV, but investigators found this had not been written into the formal standard operating procedure and recommended updating it. The full independent report has been published on the trust's website and circulated to staff, and support continues for affected colleagues.