Royal Cornwall Hospitals Trust Data Breach Exposed Health Details of 7,715 Staff

The Royal Cornwall Hospitals Trust admitted a data breach in February 2023 that exposed sensitive personal health information relating to 7,715 staff, which remained publicly accessible until November 2025.

The Royal Cornwall Hospitals Trust (RCHT) has admitted a huge data breach has led to many affected staff experiencing “significant distress, loss of trust and ongoing anxiety”. The breach exposed sensitive personal health information relating to almost 8,000 current and former staff. An Excel spreadsheet published in February 2023 exposed hidden sickness absence data, including sensitive health information, relating to 7,715 trust staff and 288 non-trust workers. The information remained publicly accessible until November 2025. The incident generated significant direct and indirect costs associated with incident management, specialist advice, staff communications, regulatory engagement and the implementation of strengthened information governance controls, alongside potential future costs arising from legal claims or remedial actions. The unauthorised disclosure of special category personal data created risks relating to compliance with UK GDPR and the Data Protection Act 2018.