Royal Cornwall Hospitals NHS Trust has admitted a major data breach that exposed sensitive health information about almost 8,000 current and former staff. An Excel workbook published on the Trust's own Freedom of Information disclosure log in February 2023 contained hidden sickness absence data for 7,715 Trust staff and 288 workers not directly employed by the Trust. The file stayed publicly accessible until November 2025.

The information was buried in a hidden pivot cache inside the spreadsheet, so it was not visible in the cells shown on screen but could be recovered from the file. An independent investigation, published by the Trust on 29 October 2026, found row-by-row absence records running from April 2018 to January 2023. The records included names, workplaces, sickness absence dates and reasons for absence, some of which amounted to highly sensitive health information.

Trust apologises after board hearing

The Trust's board heard on Thursday 5 November that the breach had caused affected staff "significant distress, loss of trust and ongoing anxiety". The Trust apologised for the incident. The investigation found weaknesses across data preparation, review, sign-off and publication, including inadequate checks for hidden spreadsheet data and a failure to convert the response to PDF before publishing.

No financial or banking details were included, and the cache contained no National Insurance numbers, home addresses or contact details. Patient care was not directly affected. The Trust removed the file, notified the Information Commissioner's Office and NHS England, contacted affected staff and says it has strengthened its controls. Local reporting says the ICO has closed its case after the Trust put its recommendations in place. This was an accidental disclosure, not a hack: no attacker, malware or intrusion has been connected with the incident. Read the local report in The Post and the technical summary at CyPro.