decrypted · 9 november 2026 · supply chain · ai and llm security · surveillance and privacy

A hospital's FOI spreadsheet carried staff health records for 33 months

No hacker, no malware and no zero-day (a flaw attackers use before a fix exists) were involved in one recent NHS data incident. A spreadsheet answering a Freedom of Information request went onto the public website of Royal Cornwall Hospitals NHS Trust in February 2023 and stayed there for 33 months, carrying health and sickness records for thousands of staff. The trust's independent review reached its board on 5 November.

What was exposed

The trust said at the time that the file held sickness absence records for current and former employees, covering April 2020 to May 2023, and that no patient or financial data was affected. The review, as reported by The British Eye, puts the number of workers at 8,003, of whom 7,715 were trust employees. The ICO, the UK's data regulator, has since closed its case after the trust implemented the recommendations.

The drawer behind the summary

Picture a filing cabinet with a tidy summary pinned to the front. The sheet that staff saw looked harmless. But Excel pivot tables, the feature that lets a summary be re-cut in different ways, keep the underlying rows inside the file so the cabinet can be reopened. The review reported that the confidential records were still reachable through the workbook's pivot tables. A member of the public found them in November 2025.

What the defender could see was thin. Website logs covered only the previous 12 months and showed 340 accesses. Investigators could not say how many were people and how many were web crawlers, so the trust could not say who had read what.

Where the process leaned on memory

The request went to the e-Rostering team, not the People Information Unit that knew the data. Staff were told to convert spreadsheets to PDF before publishing, and did not. An officer either did not run Excel's Document Inspector or did not act on what it found. The approval step asked whether the answer met the request, and assumed somebody had already checked the contents. Everyone trusted someone else to have checked.

The design lesson, and its price

Every safeguard here depended on a person remembering. Secure by Design asks for the opposite: a publishing route that cannot carry hidden data, however rushed the day. That means a default output of flat CSV or PDF generated from the data owner's system, a named approver from the team that holds the data, and logs kept long enough to answer "who saw it". None of that is expensive. The trust has since required password protection for workbooks and senior information governance sign-off for spreadsheets, though the review noted the CSV rule is not yet in the formal procedure.

Compare that with the bill for not doing it. A helpline meant to run for two weeks ran for 11, staffed by clinical governance colleagues given a day's notice and a script about 30 minutes before opening. Some call handlers had their own data in the file.

Also this week

A bank, a supplier's platform and a very large withdrawal. Crédit Mutuel Arkéa, a French cooperative bank with more than 5.8 million members, said on 4 November that attackers reached one of its internal accounts through an unnamed service provider's platform, then moved money to other institutions. The blockchain investigator ZachXBT put the loss at up to 118 million euros, about $133 million. The bank would not confirm that, saying only that it could validate the order of magnitude, and it says customer assets are unaffected. ZachXBT also claimed that the lack of early public disclosure let around $30 million be laundered before it could be frozen. That is his claim, not the bank's. The Secure by Design question for UK finance, and for any firm that lets a supplier near money: does a supplier's platform hold a standing route into an account that can pay out, and is that route watched with the same suspicion as an outsider? Least privilege for suppliers is a contract term and an engineering control, and only the second works at three in the morning.

An AI model that finds bugs faster than most teams patch them. OpenAI says its new GPT-6 Cyber model found 81 previously unknown high-severity flaws in Firefox, which Mozilla has been fixing, and developed local privilege escalation exploits, the kind that turn an ordinary user into an administrator, for 948 Linux kernel vulnerabilities. OpenAI rates the model Critical under its own Preparedness Framework and limits it to approved customers in its Daybreak Red programme. Every figure here comes from OpenAI's announcement, and the coverage we read describes no independent verification, so treat them as claims. The point for UK organisations does not depend on the exact numbers: if finding and exploiting bugs gets cheaper, the time between a patch and an attack shrinks. Systems built so that one flaw cannot reach everything, through segmentation, least privilege and fast, boring update routes, age better than systems that rely on being patched in time.

Sources

If you want help making your own publishing and supplier routes safe by default, get in touch.