Royal Cornwall NHS trust breach helpline left staff with significant emotional burden
- Severity
- Medium
- Sources
- 1
What happened
Royal Cornwall Hospitals NHS Trust exposed sickness absence and sensitive health data for 8,003 people via an Excel FOI disclosure log file, uploaded February 2023 and discovered by a member of the public in November 2025. Pivot table caches were retained; Document Inspector was not run or its findings acted on, and PDF conversion was not enforced. Logs covered 12 months and recorded 340 accesses, which may include crawlers. Remediation includes mandatory password protection for FOI workbooks and senior information governance sign-off. Investigators found the recommended CSV conversion, circulated in November 2025, had not been added to the formal operating procedure. No CVE applies.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them