Liverpool University Hospitals NHS Foundation Trust told roughly 14,000 members of staff in February 2023 that their personal details had been exposed through an emailed spreadsheet.
The file was circulated to managers to support the handling of payroll during industrial action. It contained a hidden tab that was not visible to recipients and that should not have been in the document at all. That tab held names, addresses, dates of birth, National Insurance numbers, gender, ethnicity and salary information. Bank account details were not included.
Accounts of the distribution list vary. National Health Executive reported that the spreadsheet went to around 450 managers, and that 24 external email accounts, belonging to trust staff, also received it. Infosecurity Magazine described the file as reaching hundreds of NHS managers and 24 external accounts. Staff were notified by email on 8 February 2023.
Chief executive James Sumner said the trust began deleting the email and the data file from its systems within an hour of discovering the error, completed a recovery and deletion process, and contacted every external recipient, all of whom confirmed they had deleted the file.
The trust referred the incident to the Information Commissioner's Office, commissioned an external review and assessed the risk to affected individuals as low.