Almost 14,000 staff at Liverpool University Hospitals NHS Foundation Trust (LUHFT) have had their private information, including salary details, leaked to hundreds of people via email, the Liverpool Echo has reported.
The major data breach occurred during a routine email to 450 managers pertaining to arrangements for the ongoing industrial action, when a spreadsheet was accidentally shared as well.
In the spreadsheet, personal information including staff names, their addresses, ethnicities, dates of birth, national insurance numbers, and salaries was included within a hidden tab.
The incident will now be subject to an external review and has been referred to the Information Commissioner’s Office.
A message seen by the Liverpool Echo to staff from LUHFT Chief Executive, James Sumner, read: “I am sorry to inform you that there has been an unintentional sharing of staff personal information. A file was sent by email to a number of managers within LUHFT to support the ongoing management of payroll details as part of the industrial action arrangements.
“The spreadsheet file included a hidden tab which contained staff personal information. Whilst it was not visible to those receiving the email, it should not have been included in this spreadsheet. The information in this hidden tab included names, addresses, DOBs, NI numbers, gender, ethnicity, salary, it did not include bank account details.
“The inclusion of this information was a mistake, and we are truly sorry that this has happened and for any concern this may cause. Although this has been assessed by the trust as being low risk to individuals, I felt it important and right that we inform colleagues of the situation as soon as we were able to do so.
“As the file also went to 24 external email accounts (still relating to our own staff) it has been necessary to contact each individual, to confirm deletion of the file. This recovery and deletion process was completed yesterday and I wanted to update colleagues as soon as possible.”
Sumner added in a statement: “We have apologised to our colleagues for this error and are providing them with the full information and support they need. The data was emailed to managers within the organisation, we set about deleting the email and the data file from our systems within an hour of the error being identified and action has been taken to prevent this from happening again.”
LUHFT will now contact those affected by the leaks in the coming days.
