NHS breach helpline left staff carrying a 'significant emotional burden'

What happened

Staff at the Royal Cornwall Hospitals NHS Trust were moved to a helpline after their colleagues' health data was leaked online. The helpline was meant to run for two weeks. It ran for 11 weeks. A review says the work caused a "serious emotional impact" on the staff who answered the calls.

Key numbers and facts

• The breach affected 8,003 people, including current and former trust staff and non-trust workers.
• The helpline was supposed to run for 2 weeks in December 2025. It was closed after 11 weeks, in February 2026.
• Staff were told about the helpline just one day before they had to start.
• The leaked spreadsheet included sickness records for 7,715 staff and 288 non-trust workers.

How the data leaked

In February 2023, the trust answered a Freedom of Information request. It posted a spreadsheet on its public disclosure log. The file still held hidden sickness records. Users could see them through a pivot table, which is a tool that sorts and summarises data in a spreadsheet. A member of the public found the problem in November 2025.

Why it matters

The review shows that people who help others after a data leak need support too. The call handlers had little training and no clear process. They had to judge safety risks, such as people in danger from abuse, with no plan. Many also found out their own data was exposed while they were already working. The review says this put a heavy emotional load on them.

What to watch

• The full review is published online and has been shared with staff.
• Trust officials discussed the findings at a board meeting.
• Watch for changes to how the NHS plans and supports staff during future data breaches.