Staff members at Royal Cornwall Hospitals NHS Trust were told just one day before they would operate a helpline after colleagues' health data was exposed online, according to a review published almost exactly a year after the trust disclosed a data breach affecting 8,003 people. The workers faced distressed callers, safeguarding concerns involving domestic abuse, and what the review described as a "serious emotional impact." The breach exposed sickness absence records and sensitive health information for 7,715 staff members, 288 non-trust workers, and a small number of unidentified records after an Excel workbook published in response to a Freedom of Information request in February 2023 retained underlying data that users could access through its pivot tables.
The spreadsheet remained publicly available for 33 months before a member of the public discovered the exposure in November 2025. Trust logs covering the final 12 months before discovery showed the document had been accessed 340 times, though officials couldn't determine how many views led to pivot tables being accessed or whether web crawlers rather than humans accounted for some traffic. Call handlers reported difficult interactions involving shouting, anger, and distress, with particularly challenging calls coming from people upset by the sensitivity of disclosures or potentially in danger from domestic abuse. Most call handlers only learned their own data had been exposed while already working on the helpline, sometimes minutes before supporting others affected. The helpline was originally scheduled to run for two weeks in December 2025 but operated for 11 weeks, finally closing in February 2026 due to call volume.
The review noted that "such occurrences of anger or distress were not infrequent, and this reflected the heightened emotions and distress experienced by callers to varying degrees due to the breach." This situation "placed significant emotional burden on individuals working in the contact center, who were not prepared or provided support on how to deal with those," according to the report. Staff working in the call centers had a short training session and then calls started coming in within minutes of the team being set up, with some workers not having finished reading the pre-prepared script that arrived only 30 minutes before the center went live. Call handlers said they had to make safeguarding assessments without training or an established process, and felt they had little choice about taking on the work while being expected to maintain their usual duties alongside it.
The breach occurred because the trust's e-Rostering team handled the FOIA request instead of the People Information Unit, which had expertise in responding to requests with complex datasets. One FOI officer assigned to the response either failed to run the spreadsheet through Excel's Document Inspector, which formed part of usual procedures, or failed to act upon its recommendations—a feature that can flag pivot tables and potentially hidden cached data but cannot determine whether that data is sensitive or automatically remove the cache. Staff also failed to follow instructions to convert the spreadsheet to PDF, which investigators found would have prevented users clicking through to the underlying records. The trust's sign-off process focused on answering the request's questions and meeting public relations duties, and falsely assumed that the data had been adequately sanitized before the final review.
The trust has implemented several changes to prevent recurrence, including mandatory password-protecting of any Excel workbook as part of FOIA responses. A senior information governance officer must now approve spreadsheet responses before executive sign-off, and revised guidance circulated in November 2025 called for conversion to CSV, though investigators found this requirement hadn't been incorporated into formal operating procedures and recommended updating it. The Information Commissioner's Office closed its case after the trust implemented its recommendations. The trust spokesperson said the organization remains committed to learning from this incident and continues to provide support to colleagues who have been affected. The gap between procedural safeguards on paper and their enforcement in practice can turn routine transparency obligations into costly crises that ultimately fall on frontline workers to resolve.