Ethical Hacking News
The Royal Cornwall Hospitals NHS Trust has been at the center of controversy in recent months, with a data breach affecting 8,003 people. A review of the incident has revealed that the staff assigned to a helpline faced a "significant emotional burden" due to the nature of the calls they received. The trust has implemented changes to prevent a recurrence of the breach, including mandatory password-protecting of Excel workbooks and requiring a senior information governance officer to approve responses before executive sign-off. The incident highlights the need for robust processes and procedures, as well as the importance of staff training and preparation in dealing with difficult situations.
8,003 people, including trust staff and non-trust workers, had their data exposed online due to a data breach. The breach was caused by the trust's e-Rostering team not following standard procedures for responding to FOIA requests. Staff assigned to a helpline faced a "significant emotional burden" due to the nature of the calls they received. The staff received little preparation for dealing with the calls, and had to make safeguarding assessments without training or an established process. The helpline was initially intended to run for two weeks but was stood down after 11 weeks due to the volume of calls. The trust has implemented changes to prevent a recurrence of the breach, including password-protecting Excel workbooks and requiring a senior information governance officer to approve spreadsheet responses.
The Royal Cornwall Hospitals NHS Trust has been at the center of controversy in recent months, with a data breach affecting 8,003 people, including current and former trust staff and non-trust workers, being exposed online. The incident led to the creation of a helpline, staffed by team members who were tasked with dealing with the distressing consequences of the breach. However, a recent review has revealed that the staff assigned to the helpline faced a "significant emotional burden" due to the nature of the calls they received.
The breach, which occurred in November 2025, was initially reported in a spreadsheet published in response to a Freedom of Information Act (FOIA) request. The spreadsheet contained personal data, including sickness absence information and sensitive health data, which was inadvertently exposed. The incident was later discovered by a member of the public, who alerted the trust to the issue.
An investigation into the breach found that the trust's e-Rostering team had handled the request, but failed to follow standard procedures for responding to FOIA requests. The team had compiled the response using their own data, but incorrectly believed that they had stripped the sensitive data from the spreadsheet. The trust's sign-off process also failed to ensure that the data had been adequately sanitized before being made publicly available.
The review highlighted that the staff assigned to the helpline had received little preparation for dealing with the calls that followed. They had to make safeguarding assessments without training or an established process, and faced difficult calls involving shouting, anger, and distress. The review noted that the staff had a short training session, but were expected to maintain their usual duties alongside taking on the work of the helpline.
The helpline was initially intended to run for only two weeks, but was eventually stood down after 11 weeks due to the volume of calls. The review stated that some staff members had given up weekends and worked long past their scheduled hours to meet the demands of both roles.
The trust has since implemented a number of changes to prevent a recurrence of the breach. These include the mandatory password-protecting of any Excel workbook as part of FOIA responses, and the requirement for a senior information governance officer to approve spreadsheet responses before executive sign-off. The trust has also revised its guidance to require conversion to CSV, which would have removed the pivot-table functionality and embedded cache from the spreadsheet.
The review has been circulated among staff, and published online. The trust has expressed its apologies for the breach and the distress it caused, and has stated that it has learned from the incident and will take steps to prevent a similar event from happening again.
In a statement, the trust said: "We are deeply sorry for the accidental sharing of sickness absence data which we reported in November 2025, and for the distress and concern it caused those colleagues whose data was involved. An independent investigation has now been completed, and the report has been published in full on our website in the interests of transparency and accountability. We have already implemented a number of measures to strengthen our processes, particularly around the management of Freedom of Information requests and responses. The protection of personal information is of the utmost importance to us, and we remain committed to learning from this incident and preventing a similar event from happening again. We continue to provide support to colleagues who have been affected."
The incident highlights the need for robust processes and procedures to be in place when dealing with sensitive data. It also emphasizes the importance of staff training and preparation in dealing with difficult situations. The trust's actions demonstrate a commitment to transparency and accountability, and serve as a model for other organizations to follow.
Related Information:
https://www.ethicalhackingnews.com/articles/NHS-Breach-Helpline-A-Trailblazer-in-Transparency-and-Accountability-ehn.shtml
https://www.theregister.com/security/2026/11/07/nhs-breach-helpline-left-staff-carrying-a-significant-emotional-burden/5308201
https://www.bbc.com/news/articles/cmx2ddnvp371o
Published: Sat Nov 7 05:26:54 2026 by llama3.2 3B Q4_K_M
