NHS Staff Endured 'Significant Emotional Burden' After Data Breach Helpline
A review found NHS staff faced severe emotional distress and inadequate support while managing a helpline following a data breach that exposed sensitive health information of over 8,000 individuals.
Staff members drafted to manage a helpline after a significant data breach within the Royal Cornwall Hospitals NHS Trust experienced profound emotional distress, according to a recent review. The breach, which occurred when an Excel workbook containing sensitive sickness absence records was inadvertently published via a Freedom of Information request in November 2025, exposed the personal health data of 8,003 individuals, including current and former trust staff.
Call handlers, many of whom discovered their own data was compromised while on duty, reported dealing with callers who were angry, distressed, and sometimes in situations of potential danger, such as domestic abuse. The review highlighted that these staff members were often required to make safeguarding assessments without adequate training or established protocols, adding to their already significant emotional burden. "Such occurrences of anger or distress were not infrequent, and this reflected the heightened emotions and distress experienced by callers to varying degrees due to the breach," the report stated.
Compounding the difficulty, many of the staff assigned to the helpline were drawn from the trust's clinical governance team. Despite their experience with patient trauma, they received minimal preparation for the calls. "The staff working in the call centers had a short training session and then the calls started coming in within minutes of the team being set up," the review noted, with some handlers not even having time to read the prepared script before taking calls.
The helpline, initially planned to operate for just two weeks in December 2025, was extended to 11 weeks due to the overwhelming volume of calls. Staff reported feeling they had little choice in taking on the demanding work and were often expected to juggle helpline duties alongside their regular responsibilities, with many sacrificing weekends and working extended hours.
The breach itself stemmed from an Excel workbook published in response to a Freedom of Information request. The workbook, intended to be anonymized, retained underlying sickness absence records that could be revealed through its pivot tables. The review identified several failures in the process, including the request being handled by the e-Rostering team instead of the more experienced People Information Unit, and a failure to adequately strip sensitive data before publication.
Standard procedures, such as running the spreadsheet through Excel's Document Inspector or converting it to a PDF to prevent access to underlying data, were either skipped or not fully implemented. Internal guidance at the time also did not mandate conversion to CSV, which would have disabled the pivot-table functionality. The trust's sign-off process focused on answering the request and PR duties, mistakenly assuming the data was sanitized.
The spreadsheet remained accessible for 33 months, though logs only covered the 12 months prior to the issue being flagged, during which it was accessed 340 times. The trust has since implemented changes, including mandatory password protection for Excel workbooks in FOIA responses and requiring senior information governance approval before executive sign-off, to prevent similar incidents.
This incident underscores the critical need for robust data handling protocols, thorough staff training, and adequate support systems when responding to data breaches, particularly when sensitive personal and health information is involved. The prolonged emotional toll on staff highlights the human cost of cybersecurity failures.