An internal review into a healthcare data breach has revealed severe incident response failures after an unsecured spreadsheet exposed the sensitive sickness records of 8,003 personnel. As reported by The Register, the Royal Cornwall Hospitals NHS Trust drafted unprepared staff into an incident helpline on short notice, subjecting handlers to intense distress, safeguarding dilemmas, and burnout.

How Cached Pivot Tables Leaked Sensitive Records

The leak originated in February 2023 when the trust published an Excel workbook to its public Freedom of Information Act (FOIA) disclosure log in response to an inquiry regarding workplace stress. Although handlers believed they had scrubbed the file, underlying sickness absence records remained embedded in the workbook's pivot table cache.

Users examining the published file could click into the pivot tables to reveal the underlying source data. In total, the incident exposed sensitive medical absence records belonging to 7,715 trust employees, 288 non-trust workers, and several unidentified individuals. The file remained accessible online for 33 months until a member of the public identified the exposure in November 2025.

Technical logs retained only the 12 months preceding the discovery. During that window, the file was accessed 340 times, though investigators could not verify whether human visitors or search engine crawlers generated the traffic, nor whether individuals extracted the cached data.

Procedural Lapses Behind the Disclosure

Investigators discovered multiple breakdown points across the trust's data handling workflows. The request was incorrectly routed to the trust's e-Rostering department instead of the People Information Unit, which possessed specialized experience in sanitizing complex personnel datasets.

During document preparation, standard information security controls were bypassed. A designated FOI officer failed to run Excel's Document Inspector or ignored its warnings regarding embedded data. While Document Inspector flags cached pivot data, it does not assess sensitivity or strip caches automatically.

Internal instructions requiring documents to be converted to PDF format were also missed. Furthermore, trust guidelines at the time did not mandate conversion to CSV format, an operational step that strips out underlying caches and dynamic pivot functions entirely. Meanwhile, executive sign-off focused purely on public relations messaging, erroneously presuming technical staff had sanitized the dataset.

Human Toll on Incident Response Handlers

The operational fallout placed an unexpected strain on internal personnel. Members of the clinical governance team were given 24 hours of notice that they would operate a support helpline for affected colleagues. Scripts arrived just 30 minutes before phone lines went live, leaving operators virtually no time to prepare.

Helpline workers faced aggressive and deeply distressed callers, including individuals expressing fears regarding domestic abuse. Handlers had to navigate safeguarding interventions without established escalation protocols or specialized training. Many operators discovered that their own medical records had been leaked only minutes before taking calls from other impacted workers.

Originally intended to operate for two weeks in December 2025, call volumes forced the trust to extend the helpline for 11 weeks before standing it down in February 2026. Staff sacrificed personal time and worked past their scheduled shifts to balance helpline duties with regular clinical governance responsibilities.

Remediation and Safeguards

Following the independent review, Royal Cornwall Hospitals NHS Trust instituted procedural reforms across its public disclosures. Workbooks released through FOIA processes must now be password-protected, and all spreadsheet responses require review and sign-off by a senior information governance officer prior to executive approval.

Investigators also recommended formally integrating mandatory CSV conversion into operating procedures to eliminate cache persistence. The UK Information Commissioner's Office closed its investigation into the matter after the trust implemented the review's security recommendations.

What You Should Do

Organizations publishing statistical datasets must implement robust redaction and sanitization procedures to prevent hidden data leaks:

  • Eliminate dynamic document formats: Always export datasets destined for public release into plain CSV or flat text formats. This permanently detaches dynamic pivot caches, hidden rows, and underlying source records.
  • Enforce multi-tier data sanitization: Ensure specialized data privacy or records management teams process requests involving personnel or medical records, rather than operational business units.
  • Implement pre-publish verification checks: Require senior information governance officers to validate that source documents contain no metadata, embedded objects, or secondary sheets before public distribution.
  • Prepare incident response personnel: If operating an internal crisis line, provide staff with clear safeguarding protocols, structured escalation pathways, and adequate mental health support rather than relying on unbriefed operational teams.