Threat Intelligence Brief
Curated summary with source attribution
Source: cypro.co.uk
Threat Risk: Medium
Victim: Healthcare employees (Royal Cornwall Hospitals NHS Trust)
Incident: Inadvertent public disclosure of sensitive staff health records via an Excel workbook.
Impact: Exposure of names and sensitive health information for approximately 8,000 individuals.
Attacker: None reported
Analysis: The breach occurred because a pivot table cache retained raw employee records despite the source sheet being hidden. This highlights a common blind spot where standard sanitization tools, like Excel’s Document Inspector, fail to clear specific cached business intelligence data. The incident underscores the danger of publishing editable workbooks over static formats like PDFs.
Recommendations: Convert spreadsheets to PDF or static images before public disclosure; Implement multi-stage review processes by data experts for FOI requests; Avoid using Pivot Tables in documents intended for external distribution
Source: CyPro
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source