THE Royal Cornwall Hospitals Trust (RCHT) has admitted a huge data breach has led to many affected staff experiencing “significant distress, loss of trust and ongoing anxiety”.

The breach exposed sensitive personal health information relating to almost 8,000 current and former staff.

An Excel spreadsheet published in February 2023 exposed hidden sickness absence data, including sensitive health information, relating to 7,715 trust staff and 288 non-trust workers. The information remained publicly accessible until November 2025.

No financial or contact details were disclosed and patient care was not directly affected. However, the breach affected staff wellbeing and their trust in RCHT’s ability to safeguard employee information, as well as causing substantial operational demands and costs.

A meeting of the trust’s board today (Thursday, November 5) heard that an independently commissioned investigation into the Freedom of Information (FOI) staff data breach has now been completed. The investigation report was shared with all RCHT staff, including those affected, last week.

The investigation identified weaknesses across data preparation, review, sign-off and publication, including inadequate safeguards against hidden spreadsheet data and failure to follow the requirement to convert the response to PDF. Following discovery, the trust removed the data, notified regulators and affected individuals, provided staff support and strengthened controls.

RCHT board chairman David Allen said the trust wanted to deal with the data breach “honestly, openly and transparently”.

He added: “This is something that clearly should never have happened and I’m sure the board would want to associate itself with the apology to everyone affected, which the chief executive and chief nursing officer have already given.”

Bernie George, the trust’s acting chief nursing officer, acknowledged the “absolute distress and loss of trust this caused”. She said the comprehensive investigation report identified weaknesses across data handling, checking and publication, rather than a single isolated error.

“Controls have been strengthened and the Information Commissioner’s Office has closed its case following implementation of its recommendations,” she added. “However, we have further work to do to improve safeguards across data sharing, digital literacy, instant preparedness and compassionate staff support.”

As well as the effect on almost 8,000 staff, the incident generated significant direct and indirect costs associated with incident management, specialist advice, staff communications, regulatory engagement and the implementation of strengthened information governance controls, alongside potential future costs arising from legal claims or remedial actions.

The trust has noted that the unauthorised disclosure of special category personal data created risks relating to compliance with UK GDPR and the Data Protection Act 2018, exposing it to potential regulatory scrutiny, legal challenge and reputational damage.

RCHT has now formulated an action plan to respond to recommendations in the investigation report. These include extending safeguards beyond FOI responses to all forms of data sharing and increasing digital literacy training, particularly around spreadsheets and hidden data.

Adam Broome, non-executive RCHT director, said it felt like a “really thorough response to an incident that obviously we would have preferred not to have happened”.

He raised a concern that wider trust training, rather than for those teams directly affected, was due to be completed by the end of November but hadn’t been started. He was told there had been some “challenges” around sickness absence and there will be a revision to when that training will be completed.