Data Breach Response Plan: An NHS Breach Helpline Planned for Two Weeks Ran for 11, and What Your Business Should Have Ready

An NHS hospital trust in England published a spreadsheet that turned out to contain hidden sickness records for thousands of its own staff. The helpline it set up afterwards was reportedly planned for two weeks and ran for 11. If your business ever has to tell customers or employees that their data was exposed, the phone calls that follow are part of the incident too, and this story shows what happens when nobody plans for them.

What happened at Royal Cornwall Hospitals

What the trust has confirmed. On 15 December 2025, Royal Cornwall Hospitals NHS Trust said an editable spreadsheet containing staff data had been accidentally released in response to a Freedom of Information (FOI) request. The file held staff sickness absence records from April 2020 to May 2023. The trust said no patient data or financial information was compromised. It also said it had:

• reported the incident to the Information Commissioner's Office (ICO), the UK data protection regulator
• removed the spreadsheet from its disclosure log and suspended the log during a full review
• written to current and former employees at their last known address
• brought in a new process that requires spreadsheet files to be "fully disabled" before any FOI disclosure, plus extra data handling checks

What has been reported from the trust's review. On 7 November 2026, The Register reported on a review of the incident included in the trust's public board papers for its 5 November 2026 meeting. The board pack is a very large PDF that we could not open, so everything in this section comes from The Register's account, not from our own reading of the review:

• 8,003 people were affected: 7,715 trust staff, 288 non-trust workers and a small number of records that could not be identified.
• The sickness data was not visible in the normal view, but anyone could reveal it through the spreadsheet's pivot tables.
• A member of the public spotted the problem in November 2025.
• The request was handled by the e-rostering team, not the team with FOI experience in complex datasets. Excel's Document Inspector was either not run or its findings were not acted on, and a planned conversion to PDF was not completed. Sign-off focused on answering the request and wrongly assumed the data had been cleaned.
• Access logs for the file's final 12 online show 340 accesses. The trust cannot tell how many were people, or how many opened the hidden data.
• The ICO closed its case after the trust put the review's recommendations in place.

The breach helpline: two weeks planned, 11 weeks served

This is the part that should worry any business owner. According to The Register's reporting of the review:

• Staff were told just a day beforehand that they would be running the helpline.
• They got a short training session. The call script arrived 30 minutes before go-live, and calls started within minutes.
• The helpline was meant to run for two weeks in December 2025. Because of call volume, it was not stood down until February 2026, after 11 weeks.
• Callers were shouting, angry and distressed. Some calls involved people in danger from domestic abuse, and call handlers made safeguarding decisions without training or an agreed process.
• The review says this "placed significant emotional burden on individuals working in the contact center, who were not prepared or provided support on how to deal with those." One staff member told the reviewers: "It's typical NHS, it runs on goodwill."

What is not known: the reports we read do not give the number of calls, how many people staffed the line, or what the response cost.

Why a breach response plan matters for your business

You do not need to be a hospital for this to happen to you. Two separate failures are at work here, and both are common.

The file failure. Spreadsheets carry more than you can see: hidden rows, columns and sheets, comments, metadata, and pivot tables that can hold the full source data behind a summary. Any business that emails spreadsheets to clients, posts reports on its website or answers vendor questionnaires can leak data the same way. If you publish files online, our post on whether your website is live, findable and locked covers what else may be exposed.

The response failure. A notification letter creates phone calls. If no one has decided who answers them, the job falls to whoever is nearest, often reception, customer service or HR, with no script and no idea when it will end. The US Federal Trade Commission's breach guide for businesses advises naming one point person to release information, anticipating the questions people will ask, posting plain-language answers on your website, and telling people where updates will appear. It also says staff should know where to send information that could help the investigation.

The NHS case adds three lessons the guides mention less often:

• Plan for weeks, not days. The trust's own estimate was off by more than five times.
• Sensitive data brings sensitive calls. HR, health and payroll records mean callers who are frightened, angry or at risk. Someone trained has to own those calls.
• When the data is about your staff, your staff are also the callers. Colleagues may be answering calls from colleagues about their own sickness records.

If you are not sure who would take charge on the first day, our post on who you call when systems go down is a good place to start.

Breach response checklist: what to do this week

Data breach response questions people are asking

What should a data breach response plan include?

Who leads the response, how you will contain and investigate it, who you must notify and by when, a communications plan with one spokesperson, and a plan for answering calls and emails from the people affected.

How long should a data breach helpline run?

Plan for weeks, with a way to extend it. In this case the trust reportedly planned for two weeks and needed 11.

Who should answer calls after a data breach?

People who were told in advance, trained on a script and given a clear escalation path. Do not leave it to whoever is free that day.

How can an Excel file leak hidden data?

Through hidden sheets, rows or columns, comments and metadata, and pivot tables that carry their source data with them. Run Document Inspector and publish a CSV or PDF instead.

Was patient data exposed in the Royal Cornwall breach?

The trust says no patient data or financial information was compromised. The exposed data was staff sickness absence records.

Did the ICO fine Royal Cornwall Hospitals?

The review, as reported by The Register, says the ICO closed its case after the trust put its recommendations in place. We saw no fine reported.

The bigger lesson

A breach response does not end when the file comes down. The weeks of calls, letters and worried people afterwards are where planning, or the lack of it, shows. Decide now who answers, what they say, how long they can keep going and who looks after them. Then the people answering the phone are not doing it on goodwill and a day's notice.

For help building that plan and locking down the systems behind it, see security hardening or get a quote.

Get security alerts by email, with our free checklist, at /security-alerts.

Sources: Royal Cornwall Hospitals NHS Trust: RCHT employee record data breach; The Register: NHS breach helpline left staff carrying a significant emotional burden; FTC: Data Breach Response, A Guide for Business.