The RCHT data breach exposed sensitive sickness and health information concerning thousands of current and former workers. The information was hidden inside an editable Excel workbook published through the Royal Cornwall Hospitals NHS Trust Freedom of Information disclosure log.
An independent investigation, published by the Trust on 29 October 2026, found that the workbook contained identifiable, row-level absence records for 7,715 Trust staff and 288 non-Trust workers. The file had remained publicly accessible from February 2023 until November 2025.
How the RCHT data breach happened
RCHT produced the workbook in response to a Freedom of Information request. Its visible worksheet presented aggregated sickness absence figures, which appeared suitable for publication without identifying individual employees.
However, the spreadsheet included a pivot table connected to an embedded cache of its source data. A pivot cache can retain a copy of the individual rows used to calculate totals, even when the original source worksheet is hidden or removed from view.
Someone interacting with cells in the pivot table could potentially reveal those underlying records, including by double-clicking a value or extracting information from the cache. This meant the workbook contained substantially more information than was visible when it was opened and reviewed normally.
The RCHT data breach was therefore an inadvertent public disclosure, not a reported compromise of the Trust’s network. No threat actor, malware campaign or deliberate intrusion has been connected with the incident.
Why standard spreadsheet checks did not work
The investigation found that the workbook creation and review process failed to identify the personal data retained in the pivot cache. Microsoft documentation explains that Excel’s Document Inspector cannot remove certain cached business intelligence data, including PivotCache content, because doing so may prevent workbook features from functioning.
Consequently, running Document Inspector alone does not guarantee that a workbook containing a pivot table has been sanitised. No specific Microsoft Excel version was identified as affected, and the event has not been described as a software vulnerability. It resulted from the way an Excel workbook was prepared, checked and published.
The investigation also identified several process weaknesses. The spreadsheet was prepared outside the Trust’s most experienced workforce analytics team, passed through a long chain of contributors and was reviewed under controls that did not specifically address pivot-table risks. A requirement to publish the information as a PDF was not followed.
Information exposed in the RCHT data breach
The hidden data included names, workplace information, sickness absence dates and reasons for absence. Some of the reasons amounted to highly sensitive health information, creating a clear risk of distress for affected workers even though other common identity and financial fields were absent.
The investigation identified records relating to:
- 7,715 current and former Royal Cornwall Hospitals NHS Trust staff.
- 288 workers who were not employed directly by the Trust.
- Line-by-line absence records from April 2018 to January 2023.
- Predicted absence information extending to May 2023.
No financial or banking information was included. The cache also did not contain National Insurance numbers, home addresses or contact details.
Earlier Trust communications described the relevant period as April 2020 to May 2023. The independent report instead identified older records in the pivot cache, beginning in April 2018. The public material does not explicitly reconcile the difference, although it may reflect the distinction between the intended reporting period and older source data retained by Excel.
RCHT data breach timeline and response
The affected workbook was uploaded to the Trust’s FOI disclosure log in February 2023. It remained available through the public website until November 2025, giving the incident an exposure window of approximately two years and nine months.
RCHT removed the spreadsheet after the disclosure was identified and suspended its FOI disclosure log while reviewing its processes. An official update later used inconsistent wording about whether the issue became apparent in September or November 2025. However, the independent findings and subsequent reporting place removal of the file in November 2025.
The main disclosed events were:
- February 2023: The Excel workbook was published through the FOI disclosure log.
- November 2025: The file was removed and the disclosure log was suspended.
- 5 December 2025: RCHT issued a letter to staff describing the exposed information.
- 10 December 2025: The earliest identified media coverage reported the accidental disclosure.
- 15 December 2025: The Trust published a notice covering containment and process changes.
- 29 October 2026: RCHT published the independent investigation and its findings.
- 5 November 2026: Local reporting covered the Trust board’s discussion of the findings.
The Trust contacted affected current and former staff and notified both the Information Commissioner’s Office and NHS England. It also confirmed that the original FOI requester had deleted their copy of the workbook.
Current exposure and regulatory status
The number of times the spreadsheet was downloaded while publicly available has not been disclosed. No evidence that the hidden health information was misused has been reported, but the extended publication period means the possibility of access cannot be excluded solely because no misuse is known.
Local reporting on 5 November 2026 said the ICO had closed its case after the Trust implemented recommendations. No separate public ICO case summary naming the incident has been identified, so the stated regulatory position currently rests on the Trust’s account and local reporting.
There are no published indicators of compromise such as malicious IP addresses, domains or file hashes. Such indicators would not ordinarily be expected because the RCHT data breach involved an internally produced document rather than malware or unauthorised network access.
Why hidden Excel data matters
The incident demonstrates that a spreadsheet can expose personal information even when its visible sheets contain only totals. Hiding worksheets, deleting displayed columns or running a general document inspection may not remove data embedded in caches, queries or other workbook components.
Health and sickness records require particularly careful handling. In this case, the data could connect named workers with specific absence dates and medical reasons, explaining the reported distress, anxiety and loss of trust among affected personnel.
Actions organisations should take after the RCHT findings
RCHT introduced additional checks, training on pivot tables and a process intended to ensure spreadsheet functionality is fully disabled before FOI material is released. Its response provides several directly relevant controls for organisations publishing workforce or customer data:
- Do not publish an editable workbook when a PDF or other non-editable format will meet the disclosure requirement.
- Check specifically for pivot caches, hidden sheets, queries, comments and embedded source records.
- Do not rely on Excel’s Document Inspector as the only sanitisation control.
- Require documented approval by someone who understands the workbook’s data sources and features.
- Verify the final exported document, rather than reviewing only the original working file.
The RCHT data breach was preventable, but it involved a technical feature that ordinary visual review could easily miss. Publication controls must assess what a file contains internally, not merely what it displays when first opened.
Originally reported by databreaches.net.
