A formal review into a significant data breach at the Royal Cornwall Hospitals NHS Trust has revealed that staff members assigned to a support helpline were left unprepared and unsupported while managing distressed callers. The breach, which was disclosed in November 2025, involved the accidental exposure of sensitive sickness absence records for 8,003 individuals, including current and former trust employees and non-trust workers. The records were contained within an Excel workbook published in response to a Freedom of Information (FOI) request in February 2023.
The review confirms that the helpline, initially intended to operate for two weeks in December 2025, remained active for 11 weeks due to high call volume. During this period, staff members—many of whom were drafted from the trust’s clinical governance team with only 24 hours' notice—faced callers expressing anger, distress, and concerns regarding domestic abuse or the sensitivity of the exposed data. The report highlights that these employees were forced to make complex safeguarding assessments without adequate training or established protocols. Furthermore, many call handlers discovered their own personal data had been compromised while actively working the phones, often only minutes before assisting other affected individuals.
The investigation identified systemic failures in how the trust handled the original FOI request. The task was assigned to the e-Rostering team rather than the specialized People Information Unit. Although the team attempted to sanitize the data, they failed to follow mandatory procedures, such as running the document through Excel’s Document Inspector or converting the file to a PDF or CSV format. By keeping the file in its original Excel format, the trust inadvertently left pivot tables intact, which allowed users to access hidden, sensitive information. The spreadsheet remained public for 33 months, with logs indicating at least 340 access attempts in the year leading up to the discovery of the breach.
The trust has acknowledged the findings of the independent investigation and expressed regret for the impact on its staff. In a public statement, the organization confirmed that it has implemented new security measures, including mandatory password protection for all Excel files used in FOI responses and a requirement for senior information governance officers to approve spreadsheet disclosures before executive sign-off. While the trust has updated its internal guidance to favor CSV conversions, investigators noted that these changes had not yet been fully integrated into formal operating procedures at the time of the report.
The review also noted that the Information Commissioner’s Office has closed its investigation into the matter following the adoption of these remedial measures. Despite these updates, the report underscores the heavy toll taken on the staff who operated the helpline, noting that many were expected to manage the crisis alongside their existing clinical duties, often working weekends and extended hours. The trust maintains that it continues to offer support to those affected by the exposure of their personal health and employment records.
