In February 2023, an NHS hospital trust in Liverpool, England, reported that the personal details of approximately 14,000 of its staff had been shared by mistake. A spreadsheet attached to a routine email contained a hidden tab holding employees’ names, addresses, dates of birth, National Insurance numbers, gender, ethnicity and salaries (Infosecurity Magazine; Digital Health). No one set out to leak anything. It is a clear example of the most common kind of insider risk: an ordinary person, doing an ordinary task, making an easy mistake.
The Incident
Overview of the Breach
According to reporting at the time, the email went to around 450 managers at Liverpool University Hospitals NHS Foundation Trust about arrangements for industrial action, and to 24 external accounts. The attached spreadsheet included a hidden tab with staff personal data. The tab wasn’t visible when the file was opened, but, as the trust’s chief executive put it, it “should not have been included in this spreadsheet” (National Health Executive).
The Trust’s Response
The trust reported that the email and file were deleted from its systems within an hour of the error being discovered, that all 24 external recipients were contacted and confirmed they had deleted the file, that an independent external review was commissioned, and that the incident was referred to the Information Commissioner’s Office (Infosecurity Magazine; National Health Executive).
Impact on Staff
Even when a file is recovered quickly, the people whose details were exposed bear the worry. Salaries and National Insurance numbers are personal, and staff learning that colleagues and outsiders may have seen them is distressing. Incidents like this also test trust in an organisation’s handling of personal data.
What the Incident Teaches
Hidden Data Travels with Files
Spreadsheets and documents often carry more than they show: hidden tabs, hidden columns, earlier versions, comments and linked data. A file built for one purpose and reused for another can carry sensitive data its sender doesn’t know is there.
Accidental Risk Is Still Insider Risk
Most insider incidents are negligent or accidental, not malicious. Controls that only look for bad actors miss the much more common case of a well-meaning person sending the wrong thing to the wrong people.
Speed of Response Matters
Once a file has left, the options are limited to asking recipients to delete it. The faster an organisation knows sensitive data has gone somewhere it shouldn’t, the smaller the exposure, which is why the trust’s quick action mattered.
Practical Steps for Any Organisation
Know Where Sensitive Data Lives
Personal data such as payroll extracts tends to spread into working spreadsheets, shared folders and mailboxes. Discovering and classifying it, and reviewing who can reach it, reduces the chance it ends up somewhere it shouldn’t. Sensitivity labels only help if they match what’s actually in the file.
Reduce the Chance of the Mistake
Share links to controlled locations rather than attaching copies, check files for hidden content before they are sent widely, and keep sensitive extracts separate from files used for routine communication.
Have Visibility into How Sensitive Data Moves
An insider risk program that understands how sensitive data moves, including to large or external recipient lists, gives an organisation a better chance of noticing a mistake and acting on it quickly. Alerts should be reviewed by people who understand the context, so staff aren’t treated as suspects for honest errors.
Build a Supportive Security Culture
People are more likely to report their own mistakes quickly when they aren’t afraid of blame. Training on everyday risks, such as hidden data in files and checking recipients, goes a long way.
In Summary
The Liverpool incident is a reminder that some of the most damaging data exposures come from simple, honest mistakes. Organisations handling sensitive personal data, particularly in healthcare, benefit from knowing where that data lives, reducing the chances of it being sent in error, and having the visibility and processes to respond quickly when it is. Doing so helps maintain the trust of their employees and the public.
CEO & Co-Founder, ShadowSight
Who is Christopher McNaughton
Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.
Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.