Nottingham and Southport data NHS breaches 'the tip of the iceberg', Sky finds

The NHS has a huge problem. And one of its biggest challenges is that it doesn't even know the scale of it.  

The high-profile data breaches involving the victims and survivors of the Nottingham and Southport attacks made stark headlines.

People who have been through the most harrowing nightmare have been forced to relive their ordeal again and again by NHS staff satisfying their own "morbid curiosity".

We only know about these cases because of the courage of the families involved in holding the trusts involved to account.

But it's not just high-profile cases.

Sky's investigation into NHS data breaches has found thousands of cases, many involving ordinary patients. But that does not make it any less distressing. Every data violation is a gross intrusion of privacy.

We found there were 2,914 data breach cases investigated by trusts since 2021. Of these, only 409 such cases were referred to the Information Commissioner's Office.

Some 67% of data breach cases in NHS trusts result in a minor punishment, such as an informal, verbal, or written warning or no further action.

The trusts are the gatekeepers of the patient data they hold. It is their responsibility to protect it.

But we found that of the 134 who responded to our Freedom of Information requests, only 54 said they routinely looked for potential breaches.

The identified cases, including the high-profile ones, are only the tip of the iceberg.

(c) Sky News 2026: Nottingham and Southport data NHS breaches 'the tip of the iceberg', Sky finds