Royal Cornwall Hospitals Excel pivot data leak review, The Register reports
The Register reports an NHS trust review of an FOI spreadsheet whose pivot cache exposed staff health data, check published workbooks for hidden caches.
- Published
- Ecosystem
- Enterprise softwareWebsites and CMS
- Exploitation
- No, The Register reports the file was accessed 340 times in the logged 12 months, but the review could not tell if any access reached the pivot data or was human
What happened
According to The Register, an independent review of a data breach at the Royal Cornwall Hospitals NHS Trust has been published. The Register reports that the trust disclosed the breach in November 2025 and that it affected 8,003 people, including current and former trust staff and non-trust workers.
The Register says the trust uploaded an Excel workbook to its public FOI Disclosure log in February 2023 in response to a Freedom of Information request. According to the outlet, the workbook kept underlying sickness absence records and sensitive health data that users could reveal through its pivot tables, covering 7,715 staff, 288 non-trust workers and a small number of unidentified records. The Register reports that a member of the public discovered the exposure in November 2025 and that the file was available for 33 months.
The Register summarises these process failures from the review:
- The request was handled by the e-Rostering team, not the People Information Unit, which had expertise in complex dataset FOI responses.
- An FOI officer either did not run the file through Excel’s Document Inspector or did not act on its recommendations. The outlet notes the feature can flag pivot tables and hidden cached data but cannot judge sensitivity or remove the cache automatically.
- Staff did not follow instructions to convert the file to PDF. Investigators found PDF conversion stopped users clicking through to the underlying records but could not guarantee no hidden data remained.
- Guidance at the time did not require conversion to CSV, which would have removed pivot table functionality and the embedded cache.
- Sign-off assumed the data had already been sanitised.
On access, The Register reports the trust’s logs only covered the 12 months before it was alerted. These show 340 accesses, but the review noted there was no way to know how many, if any, reached the pivot tables or were made by a human rather than web crawlers. Whether anyone extracted the hidden data is not confirmed.
Most of The Register’s story covers the trust’s breach helpline. The outlet reports that clinical governance staff were given a day’s notice to staff it, that some had not finished reading a script that arrived 30 minutes before going live, and that the helpline planned for two weeks in December 2025 ran for 11 weeks until February 2026. The review describes a “significant emotional burden” on call handlers, many of whom learned while on shift that their own data was exposed.
Am I affected?
- Trust staff and workers: The Register reports the affected group is current and former Royal Cornwall Hospitals NHS Trust staff and non-trust workers. The outlet does not say how individuals were notified beyond the helpline.
- Other organisations: The pattern in this case applies to any team that publishes Excel files derived from sensitive data. According to The Register, the exposed data came from a pivot table whose source records stayed inside the workbook. No software vulnerability or CVE is involved.
What to do now
- Review workbooks you have already published from sensitive datasets for pivot tables and cached source data. The trust’s file stayed online for 33 months before a member of the public spotted it, The Register reports.
- Do not treat Excel’s Document Inspector as a complete check. According to The Register, it can flag pivot tables and cached data but cannot decide what is sensitive or remove the cache itself.
- Prefer CSV for published tabular data where possible. The trust’s revised guidance from November 2025 calls for CSV conversion, and the review recommended adding it to the formal operating procedure, The Register says.
- Route requests involving complex datasets to the team with that expertise, and add a dedicated sign-off step. The Register reports the trust now requires a senior information governance officer to approve spreadsheet responses before executive sign-off, and mandates password protection of Excel workbooks in FOI responses.
- If you might ever need to run a breach helpline, plan for it in advance. According to The Register, the review found call handlers had to make safeguarding assessments without training or an established process.
The Register reports the Information Commissioner’s Office closed its case after the trust implemented its recommendations.