Royal Cornwall Hospitals NHS Trust asked clinicians to staff a breach helpline after 8,003 people’s sickness records leaked online, and a review has found the team went in unprepared and came out carrying lasting emotional damage.
How the data escaped
The exposure traces to February 2023. Answering a freedom of information request, the trust published an Excel workbook whose pivot tables still held sickness absence data for 7,715 staff and 288 non-trust workers. The request went to the e-rostering team rather than the unit used to complex datasets, and nothing stripped the pivot cache. A member of the public found the file in November 2025.
A day’s notice and a rushed script
The review, presented to the trust board this week, describes a contact center planned for two weeks that ran for eleven. Clinical governance staff learned a day ahead that they would answer calls. Training was brief, and some handlers had not finished a script that arrived 30 minutes before lines opened.
Callers shouted, broke down and raised safeguarding concerns, including people at risk from domestic abuse. Handlers made those calls without a process, and most learned their own data had been exposed while already on the phones. Staff gave up weekends and worked past their shifts. One told reviewers: “It’s typical NHS, it runs on goodwill.”
What changed
Spreadsheet responses now need senior information governance approval before executive sign-off, and November 2025 guidance calls for CSV conversion, which reviewers found never reached the formal operating procedure. The Information Commissioner’s Office closed its case once recommendations were adopted. The trust has apologised.
The lesson generalizes past the NHS: breach notification is an operational capability, not a comms task. Handlers need training, safeguarding pathways, supervision and support, and their own status settled before they field a stranger’s distress.
