NHS breach response took toll on staff

The call handlers who fielded questions after health data on thousands of NHS staff surfaced online were not outside contractors or a standing crisis team. They were clinical governance staff told the day before that they would be manning a helpline, according to a review of the incident. What followed, the review found, was a stretch of shouting, distress and safeguarding calls that left many of them carrying a burden no one had prepared them for.

The review concerns the Royal Cornwall Hospitals NHS Trust, which disclosed a breach affecting 8,003 people — current and former trust staff along with non-trust workers. Almost exactly a year on from that disclosure, the trust has published its findings in full and circulated them internally, according to officials who spoke at a board meeting on Thursday.

A spreadsheet, not a hack

The exposure did not begin with an intruder. In February 2023 the trust uploaded a spreadsheet to its public Freedom of Information disclosure log in response to a request believed to come from a journalist researching a story about stress in the NHS. The file carried personal data and inadvertently exposed sickness absence information and sensitive health data tied to 7,715 staff and 288 non-trust workers, plus a small number of unidentified records.

The problem was the format. The workbook retained the pivot table from which some of its figures were derived, and anyone who knew how to navigate it could pull the underlying records back out. Such data would ordinarily have been far too sensitive to include in an FOI response at all. The exposure sat there, unnoticed, until a member of the public found it in November 2025.

By the trust's account, the request was handled by its e-Rostering team rather than the People Information Unit, which held the expertise for responses involving complex datasets. The e-Rostering team built the reply from its own data and believed, incorrectly, that the sensitive material had been stripped out.

A day's notice, a script at the last minute

The helpline was stood up in December 2025 with a two-week run in mind. Members of the clinical governance team were told one day beforehand that they would staff it. They had deep experience of patient trauma, but little preparation for this particular job: the review recorded that staff got a single short training session before calls began arriving within minutes of the team being set up. Some had not finished reading a pre-prepared script that landed only 30 minutes before the center went live.

The calls were hard. Staff described shouting, anger and distress, with the most difficult ones coming from people shaken by the sensitivity of what had been disclosed, or who might be in danger from domestic abuse. Call handlers said they were making safeguarding assessments without training or an established process. Most only learned that their own data had been exposed while they were already working the lines — sometimes minutes before they were expected to support others in the same position. Several said they had little choice about taking the work and were expected to keep up their normal duties alongside it. Some gave up weekends and worked well past their scheduled hours to cover both roles.

Anger was not the exception

The review did not treat the hostile calls as outliers. It described them as a recurring feature of the work, a direct consequence of how upset callers were.

"The staff working in the call centers had a short training session and then the calls started coming in within minutes of the team being set up," the review noted. "Some staff had not finished reading the pre-prepared script which had arrived only 30 minutes before the center went live."

The review also set out the effect on the people on the other end of the line: "Such occurrences of anger or distress were not infrequent, and this reflected the heightened emotions and distress experienced by callers to varying degrees due to the breach," it noted. "This placed significant emotional burden on individuals working in the contact center, who were not prepared or provided support on how to deal with those."

One staffer summed up the culture behind the long hours in a line quoted in the report: "It's typical NHS, it runs on goodwill."

Two weeks became eleven

The center was meant to close after a fortnight. The volume of calls kept it open for 11 weeks, and it was finally stood down in February 2026. Officials at the Thursday board meeting said the review and its findings have since been circulated among staff and published online.

That the helpline ran so long is itself a measure of the response the breach drew. A two-week plan became a near-three-month operation staffed largely by people who had been drafted in with a day's warning.

The checks that were skipped

The review traced the failure to a series of missed steps. Standard procedures told request handlers to complete several checks before publishing documents. For a start, an FOI officer assigned to the response either failed to put the spreadsheet through Excel's Document Inspector — part of the usual process — or failed to act on what it flagged. That tool can point to pivot tables and possibly hidden cached data, but it cannot judge whether the contents are sensitive and does not clear the cache automatically.

Staff also did not follow instructions to convert the spreadsheet to PDF, a step investigators found would have stopped users clicking through to the underlying records, though they could not guarantee that no hidden data would have remained technically reachable. At the time, internal guidance did not require conversion to CSV, which would have removed the pivot-table function and the embedded cache altogether.

The sign-off process compounded matters. It focused on answering the questions in the request and on the trust's public relations duties, and it assumed the data had already been properly sanitized by the time it reached final review.

33 months in public view

The file stayed available for 33 months. The trust cannot say how many times it was viewed. Its logs covered only the 12 months before the member of the public flagged the pivot-table problem, and those records showed 340 accesses — a figure the review said cannot be read as a count of people who saw the data, since there is no way to know how many involved the pivot tables or whether a human was on the other end, with web crawlers adding to the total.

• 8,003 people affected by the breach in total
• 7,715 staff records and 288 non-trust worker records in the exposed spreadsheet
• 30 minutes of warning before the helpline went live, for some staff
• 2 weeks planned for the helpline, extended to 11 weeks
• 33 months the spreadsheet remained available, with 340 logged accesses in the final 12 months

What the trust has changed

According to the review, the trust has made several changes aimed at stopping a repeat. Any Excel workbook attached to an FOI response must now be password-protected. A senior information governance officer has to approve spreadsheet responses before executive sign-off. Revised guidance circulated in November 2025 called for conversion to CSV as well, though investigators found that requirement had not been written into the formal operating procedure and recommended it be updated.

The review says the Information Commissioner's Office closed its case after the trust put its recommendations in place. The trust has not suggested that the closure means the incident was minor; its statement to that effect is one of apology and of commitments made.

A spokesperson for the Royal Cornwall Hospitals said: "We are deeply sorry for the accidental sharing of sickness absence data which we reported in November 2025, and for the distress and concern it caused those colleagues whose data was involved."

The spokesperson added: "An independent investigation has now been completed, and the report has been published in full on our website in the interests of transparency and accountability."

The statement continued: "The investigation has helped us understand what happened and identify areas where improvements were needed. We have already implemented a number of measures to strengthen our processes, particularly around the management of Freedom of Information requests and responses."

It went on: "The protection of personal information is of the utmost importance to us, and we remain committed to learning from this incident and preventing a similar event from happening again." It closed with a note that the trust continues to provide support to colleagues who have been affected.

Why the human cost matters

Most post-incident reports measure a breach in records, notifications and remediation steps. This one spends much of its length on the people who had to answer the phones, and it is a reminder that a data exposure creates a second wave of harm inside the organization that disclosed it. Staff whose own sickness records were in the file were reassuring callers about the same disclosure before they had processed what it meant for them — a sequence that seems difficult to plan for and easy to overlook.

For other public bodies handling FOI requests, the mechanics here are worth reading closely. The exposure came from a routine publication, not an attack, and it survived because a tool flagged something no one acted on, a conversion step was skipped, a sign-off assumed the work had been done, and no one required the format that would have removed the risk. Each of those is a small process gap; together they kept sensitive records reachable for nearly three years. This suggests the practical lesson is less about exotic threats than about the last mile of publishing spreadsheets — the password, the PDF or CSV, the second pair of eyes from someone who understands what a pivot table can reveal.

For the trust's workforce, the review offers an acknowledgment more than a fix. It records that the helpline ran on goodwill and that the emotional load fell on people who had a day's notice and half an hour with a script. Whether the published review changes how the next incident is staffed is not something the document can answer. What it does establish is that the response to a breach can be its own source of distress, and that the review found the trust unprepared for that part of the job.