"We are deeply sorry for the accidental sharing of sickness absence data which we reported in November 2025, and for the distress and concern it caused those colleagues whose data was involved." A spokesperson for the Royal Cornwall Hospitals said those words after an independent review found staff drafted on to an emergency helpline carried a "significant emotional burden" responding to calls from people whose health data had been exposed online.
The exposed spreadsheet and who was affected
The review follows a disclosure first reported in November 2025, when the Royal Cornwall Hospitals NHS Trust said a data breach had affected 8,003 people. An Excel workbook uploaded to the trust's public Freedom of Information (FOIA) disclosure log in February 2023 contained sickness absence records and sensitive health data related to 7,715 staff, 288 non-trust workers and a small number of unidentified records. Crucially, the spreadsheet retained pivot tables and cached data that allowed users to reveal underlying records that should have been too sensitive to publish.
Helpline staff faced anger, distress and safeguarding gaps
The review documents that staff who were conscripted to run a helpline described callers who were shouting, angry and distressed. The report says: "Such occurrences of anger or distress were not infrequent, and this reflected the heightened emotions and distress experienced by callers to varying degrees due to the breach." Call handlers reported particularly difficult contacts from people upset by the sensitivity of disclosures and from those possibly in danger from domestic abuse. They said they were required to make safeguarding assessments "without training or an established process."
Members of the trust's clinical governance team were told only a day before they would staff the helpline. Despite experience dealing with patient trauma, they received minimal preparation: "The staff working in the call centers had a short training session and then the calls started coming in within minutes of the team being set up," the review noted. A pre-prepared script had arrived only 30 minutes before the centre went live, and most call handlers discovered their own data had been exposed while already answering calls, sometimes minutes before supporting others affected.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleOperational failures that let the workbook go public
Investigators identified several procedural errors. The FOIA request was handled by the trust's e-Rostering team rather than the People Information Unit, which the review says had the relevant expertise for complex datasets. Standard instructions—such as running the spreadsheet through Excel's Document Inspector—were either not followed or its recommendations were not acted upon. Staff also did not convert the spreadsheet to PDF, a step investigators found would have prevented users from clicking through to underlying pivot-table data.
Internal guidance at the time did not require conversion to CSV, which would have removed pivot-table functionality and the embedded cache. The trust's sign-off process concentrated on answering the request and on public relations duties, and "falsely assumed that the data had been adequately sanitized before the final review." The workbook remained available for 33 months; web logs covered only the 12 months before a member of the public alerted the trust to the pivot-table issue and showed 340 accesses during that period, though investigators could not determine how many—if any—led to pivot tables being accessed.
Measures taken, regulatory outcome and ongoing support
The trust has adopted a number of changes since the incident. Excel workbooks provided as FOIA responses must now be password-protected and a senior information governance officer must approve spreadsheet responses before executive sign-off. Revised guidance circulated in November 2025 called for conversion to CSV, though investigators found that this requirement had not yet been folded into the formal operating procedure and recommended updating it. The Information Commissioner's Office closed its case after the trust implemented its recommendations.
The review and its findings have been circulated among staff and published online. The trust's spokesperson added: "The protection of personal information is of the utmost importance to us, and we remain committed to learning from this incident and preventing a similar event from happening again. We continue to provide support to colleagues who have been affected."
What this means for NHS staff, FOIA officers, and information governance teams
- NHS staff drafted into response roles: the review underscores the emotional cost of emergency redeployment without training or support; several staff worked weekends and long hours while maintaining usual duties, and some only learned their own data had been exposed while answering calls.
- FOIA officers and e-Rostering teams: the incident highlights the risks of handling complex datasets outside expert units; investigators found steps such as Document Inspector and conversion to non-interactive formats were skipped or insufficient.
- Information governance teams and executives: the trust has introduced mandatory approvals and password protection for spreadsheets and has recommended formalising CSV conversion into operating procedures to prevent recurrence.
The independent review sets out a catalogue of human and process failures that turned a routine FOIA response into a long-running breach and an emergency support operation. The trust has published the report and says it has implemented changes; the lingering factual thread is simple and stark — an interactive Excel pivot cache exposed sensitive health data for 33 months, and it took a public alert and an 11-week helpline to surface the human consequences.
