Royal Cornwall Hospitals Trust: Excel spreadsheet exposed hidden sickness/health details of 7,715 staff
Severity: medium · Patch status: no-fix-needed · Since 2026-11-05
The Royal Cornwall Hospitals Trust (RCHT) admitted a data breach in which an Excel spreadsheet published in February 2023 exposed hidden sickness and personal health information relating to 7,715 current and former staff. The hidden data was recoverable from the published file, exposing sensitive health details. Affected staff have reported significant distress, loss of trust and ongoing anxiety. No malicious actor or in-the-wild exploitation is indicated; this appears to be an accidental disclosure via improper data handling (hidden spreadsheet columns rather than true redaction). Remediation involves proper data sanitisation/redaction practices and notification to affected individuals; no software patch applies.
What to do
- Review any published spreadsheets or documents for hidden columns, sheets, or metadata before release
- Use true data redaction rather than hiding rows/columns when sharing datasets
- Notify affected staff and offer support per UK GDPR obligations
- Assess whether the ICO must be notified and complete a breach risk assessment
- Audit other published internal files for similar exposure
Sources
All live incidents on Threat Watch
