Short answer
A spreadsheet published in February 2023 in response to a freedom of information request contained hidden sickness absence data for 7,715 Royal Cornwall Hospitals staff. It stayed publicly accessible until November 2025. The trust told its board it caused significant distress and that the ICO has closed its case.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Royal Cornwall Hospitals NHS Trust |
|---|---|
| Incident type | Data leak |
| Status | Confirmed by the organization |
| Sector | Healthcare (NHS) |
| Country | United Kingdom |
| Detected | 2025-11-01 |
| Disclosed | 2026-11-05 |
| People or records affected | 7,715 trust staff and 288 non-trust workers, per the trust's board report |
What data was exposed
- Hidden sickness absence records, including health information, for 7,715 trust staff and 288 non-trust workers
- The trust says no financial details, contact details or patient data were disclosed
What happened
Royal Cornwall Hospitals NHS Trust told its board on 5 November 2026 that a spreadsheet it published in February 2023 contained hidden sickness absence data about its staff. Radio Newquay, reporting through the Local Democracy Reporting Service, says the file revealed health information for 7,715 trust staff and 288 non-trust workers and stayed publicly accessible until November 2025.
The trust says the spreadsheet was released in response to a freedom of information request. It was an editable file, and the hidden data was not removed.
What the investigation found
An independent investigation, whose report was shared with staff last week, found weaknesses in how the data was prepared, reviewed, signed off and published. Key failures included inadequate safeguards against hidden spreadsheet data and not converting the response to PDF as required.
The trust says no financial details, contact details or patient data were disclosed, and patient care was not directly affected. DataBreaches.net notes the trust acknowledges the exposure of special category data under UK GDPR and the Data Protection Act 2018.
Impact and response
The trust told its board that affected staff experienced “significant distress, loss of trust and ongoing anxiety.” It removed the data, notified regulators and affected individuals, provided staff support and strengthened controls. Board chairman David Allen said the trust would handle the matter “honestly, openly and transparently” and that the breach “should never have happened.”
The Information Commissioner’s Office has closed its case after the trust put its recommendations in place. The reports do not mention a fine. The trust also noted possible costs from legal claims.
Next steps at the trust
Safeguards will cover all data sharing, not just freedom of information responses, and training will focus on spreadsheets and hidden data. Non-executive director Adam Broome raised concern that wider staff training due by the end of November had not started. The completion date is being revised.
What affected staff should watch for
Health information is sensitive, and people who hold it can be targeted by extortion or by unsolicited claims offers. Treat any message that claims to know about your sickness record with suspicion. Our data breach checklist explains what to do after an exposure, and the health insurance and Medicare scams guide covers fake health-related contact. See also the phishing messages guide.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing or extortion messages that claim to know about your health or sickness record and demand payment.
- Calls offering to 'help with a compensation claim' that ask for personal or bank details up front.
- Fake HR or NHS emails asking you to confirm personal details after the breach.
What to do if you are affected
- 01Read any letter or message from the trust about the breach and use the support it offers.
- 02Do not respond to anyone who says they hold your sickness record and demands money. Keep the message and report it.
- 03Be careful with claims firms that cold-call or message you. Check their registration and never give bank details to start a claim.
- 04Check any message that claims to be from NHS HR through a number or website you already know.
- 05Ask the trust's data protection team for details of what was held about you.
Frequently asked questions
How did the sickness data become public?
The trust's investigation found an editable spreadsheet was published in February 2023 in response to a freedom of information request. It held hidden data, and the response was not converted to PDF as required.
How many people were affected?
The board was told the file revealed hidden sickness absence records for 7,715 trust staff and 288 non-trust workers.
How long was the data available?
Radio Newquay reports it stayed publicly accessible until November 2025, when the trust removed it.
Was any financial or contact data exposed?
No, according to the trust. It says no financial or contact details were disclosed, and patient care was not directly affected.
What did the regulator do?
Radio Newquay reports the Information Commissioner's Office has closed its case after the trust implemented its recommendations. The report does not mention a fine.
Sources
- Cornwall hospital data breach caused 'loss of trust and ongoing anxiety', Radio Newquay (Local Democracy Reporting), 2026-11-05
- UK: Royal Cornwall Hospitals Trust data breach exposed health details of 7,715 staff, DataBreaches.net, 2026-11-05
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.