After a hidden spreadsheet feature exposed health records, staff at an NHS trust were put on the helpline with a day's notice. A review says it took a heavy toll.
Staff at Royal Cornwall Hospitals NHS Trust whose own sickness records were exposed were then asked to run the helpline for other affected people. A review found they had one day's notice and little support. It said the work put a "significant emotional burden" on them.
Callers were often angry or distressed. Some were upset by how sensitive the exposed information was. Others were potentially in danger from domestic abuse. Call handlers said they had to make safeguarding decisions, meaning judgments about whether someone was at risk, without training or an agreed process.
One script arrived only 30 minutes before the phones opened. Some staff had not finished reading it when calls began. Most learned their own data had been exposed while already working, sometimes minutes before helping others. They also kept their usual duties. One staffer said, "It's typical NHS, it runs on goodwill."
The helpline was meant to run for two weeks in December 2025. Because of call volume, it was not stood down until February 2026, after 11 weeks.
The trust answered a Freedom of Information request in February 2023 and posted a spreadsheet on its public site. The file held sickness absence and sensitive health data on 7,715 staff and 288 non-trust workers, 8,003 people in total. A member of the public found the problem in November 2025.
The cause was a pivot table, an Excel tool that summarizes data while keeping a hidden copy of the detailed records behind it. Anyone could click through to those records. The request went to a team without the right expertise, and several checks were skipped. Excel's Document Inspector can flag this kind of hidden data but cannot remove it. Converting the file to PDF was also required and was not done.
The file was online for 33 months. Logs covered only the final 12 months and showed 340 visits. The review said there is no way to know how many reached the hidden records, or whether some visits were automated web crawlers rather than people.
The trust now requires password protection on any Excel workbook used in a Freedom of Information response. A senior information governance officer must approve spreadsheet responses before executive sign-off. Revised guidance in November 2025 also called for converting files to CSV, a plain format that drops pivot tables and the hidden copy.
Before sharing a spreadsheet, check for hidden data inside it, and plan support for the people who would handle a breach.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA fake call in Truro, Canada, sent a police tactical team to a woman's home. An RCMP officer now shares plain rules for spotting phone scams.
Read more: Canadian police share simple rules to beat phone scammersKMBC 9 News has launched Scam School, a series on spotting the warning signs of scam texts and calls so you can protect your money and your family.
Read more: A local TV series shows the warning signs of phone and text scams
