Royal Cornwall Hospitals NHS Trust breach helpline staff unprepared, review finds

Royal Cornwall Hospitals NHS Trust disclosed a data breach in November 2025 that affected 8,003 current and former staff and non-trust workers. An independent review published in November 2026 found that the trust’s response helpline was staffed by members of the trust’s clinical governance team, who were given only a day’s notice and minimal training. The helpline ran for 11 weeks instead of the planned two weeks.

Helpline operation and staff impact

Clinical governance team members were told only a day before the helpline launched and received a brief training session just minutes before calls began. The prepared script arrived 30 minutes before go live, leaving some staff unable to finish reading it.

Call handlers reported frequent angry and distressed callers, including people at risk of domestic abuse, and had to make safeguarding decisions without any formal process or training. Many handlers learned that their own data had been exposed while they were already supporting others. Staff were expected to keep their regular duties and worked evenings and weekends, with some staying long past scheduled hours.

Cause of the data exposure

The breach originated from an Excel workbook uploaded to the trust’s FOI disclosure log in February 2023 in response to a request about NHS stress. The workbook retained pivot tables that contained sickness absence records and sensitive health information for 7,715 staff and 288 non-trust workers. The request was handled by the e-rostering team rather than the People Information Unit, which had the relevant expertise.

Standard sanitisation steps were skipped: the Document Inspector was not run or its warnings were ignored, the file was not converted to PDF, and internal guidance did not require conversion to CSV which would have removed the pivot-table cache. The sign-off process focused on answering the request’s questions and on public relations, and wrongly assumed the data had been properly cleared. The spreadsheet remained publicly accessible for 33 months and was accessed 340 times in the final 12 months before the issue was reported.

Remediation and ongoing actions

The trust has introduced mandatory password protection for any Excel workbook used in FOI responses, requires a senior information governance officer to approve spreadsheet releases before executive sign-off, and issued revised guidance in November 2025 calling for CSV conversion. The Information Commissioner’s Office closed its case after the trust implemented the recommendations. The trust apologised for the distress caused and continues to offer support to affected staff.

Sources: The Register