NHS data leak forces healthcare workers into emotional crisis support role

A data breach exposed sensitive health records for 8,003 NHS staff and non-staff members, triggering an 11-week emotional support helpline that overwhelmed workers with minimal training and immediate

Royal Cornwall Hospitals NHS Trust exposed health and sickness absence data for 7,715 staff and 288 non-trust workers via an Excel spreadsheet uploaded in February 2023. The breach occurred because the e-Rostering team handled a Freedom of Information request instead of the People Information Unit, skipping critical data sanitization steps like Excel Document Inspector checks. The spreadsheet’s pivot tables enabled users to access underlying sensitive data, which was discovered by a public member in November 2025. This led to an 11-week helpline for distressed staff (December 2025–February 2026), far exceeding the planned two-week duration. Workers received minimal training and support, with some learning about their own data exposure minutes before assisting others. The helpline caused significant emotional strain, including weekend work and extended shifts beyond scheduled hours.

The breach was accessible for 33 months after upload, with internal logs showing 340 accesses in the first year—though this count may include web crawlers and cannot confirm human exploitation. The trust implemented mandatory password protection for similar spreadsheets and required senior information governance approval before executive sign-off to prevent recurrence. The Information Commissioner’s Office closed its investigation after these fixes in November 2025.

This incident creates friction in healthcare access by risking staff retention and patient care quality. Emotional strain from handling data exposure incidents directly undermines the stability of frontline care, making health support less reliable for vulnerable populations. The trust’s delayed response and inadequate training highlight systemic vulnerabilities in how healthcare organizations manage sensitive data under pressure.

The trust’s implementation of new safeguards remains the critical next step. However, the 340 access count uncertainty, the 33-month exposure window, and the lack of verified human exploitation data mean the full scale of harm is still unclear. The 8,003 figure is a rounded total from the original 7,715 staff and 288 non-trust workers.

Source: The Register