NHS staff drafted into a helpline after colleagues' health data was exposed online were left carrying a significant emotional burden, an independent review has found.

Presented to the Royal Cornwall Hospitals NHS Trust board, the review examined a data breach affecting 8,003 people, discovered by a member of the public in November 2025.

A helpline set up in a day

The trust's clinical governance team were told just a day beforehand they would staff the helpline, with little preparation for the calls that followed.

Staff described difficult calls involving shouting, anger and distress. The hardest cases involved people worried about sensitive disclosures, or potentially in danger from domestic abuse, and handlers had to assess safeguarding risks without training or a set process.

"The staff working in the call centers had a short training session and then the calls started coming in within minutes," the review noted. Some had not finished reading the script, which arrived 30 minutes before opening.

Staff affected by the breach themselves

Many handlers only learned their own data had been exposed while already working the helpline. They said they had little choice about the work and kept up their usual duties alongside it, some giving up weekends and working long past scheduled hours.

The helpline was meant to run for two weeks in December 2025, but demand kept it open for 11 weeks, until February 2026. The trust has since made password protection mandatory for Excel workbooks in FOI responses.

Sources: - source2_name: Beinsure | source2_link: https://beinsure.com/news/nhs-data-breach-exposed-health-records-workers/

[Source: The Register](https://www.theregister.com/security/2026/11/07/nhs-breach-helpline-left-staff-carrying-a-significant-emotional-burden/5308201) | [Source: Beinsure](https://beinsure.com/news/nhs-data-breach-exposed-health-records-workers/)