Nobody hacked anything here. The people involved had logins they used for their jobs. What they didn’t have was a reason to open those records. That gap between can and should exists in every business that holds customer, client or staff data. Here’s what happened, what the law says, and a practical plan.
What happened?
On Friday 16 October, Nottingham University Hospitals NHS Trust (NUH) said it had now dismissed a total of 15 staff in its investigation into inappropriate access to the medical records of Ian Coates, Grace O’Malley-Kumar and Barnaby Webber, who were killed in the Nottingham attacks on 13 June 2023 (NUH) (BBC News). The trust’s breakdown of outcomes so far:
15 dismissals, 15 final written warnings and two first written warnings; in two cases there was nothing to answer and no action was taken (NUH).
Those involved include doctors, nurses, registered healthcare professionals and other staff (NUH).
In May the trust had announced its first outcomes: 11 dismissals, 12 final written warnings and two first written warnings (NUH, May 2026).
NUH started inquiries in 2025, is discussing outcomes with the Nursing and Midwifery Council and General Medical Council, and has informed the Information Commissioner’s Office (ICO) and Nottinghamshire Police. Investigations continue, including into access to the files of people who survived the attacks (NUH).
NUH medical director Dr Manjeet Shehmar said: “There is simply no excuse for accessing the records of a patient without a legitimate reason” (NUH). Grace’s father, Dr Sanjoy Kumar, said: “I am appalled, it’s time to get a handle on these failures” (BBC News).
NUH is testing a new system to continually monitor access, identify suspicious behaviour, and generate alerts, audits and reports, aiming to go live early next year, and has run a ‘Your Responsibility, Your Actions, Their Privacy’ staff campaign (NUH).
What’s confirmed, what isn’t, and what we infer
Confirmed: the numbers and actions above come from NUH’s own statement. The BBC reports court, probation and police staff also viewed information about the case without a legitimate reason (BBC News). On 25 September, NHS England told trusts to suspend staff suspected of snooping and cut off their system access while it’s investigated (NHS England).
Not said publicly (as of 18 October): which system was involved or how each case was found. In May, Barnaby’s mother, Emma Webber, told Sky News: “This wasn’t uncovered by any due diligence, this was uncovered because we insisted upon it” (Sky News). At the time, the ICO said it would assess the evidence and consider whether criminal investigations were needed; Nottinghamshire Police said there was “no criminal investigation” (BBC News, May 2026). We’ve found no public ICO update since.
What we infer (our view): logs of who opened what can show this kind of access, but only if someone checks them before the people affected have to raise it.
Why this matters to you: access isn’t a reason
This isn’t just a hospital problem. Think of your CRM, HR system, case management software, accounts package and shared mailboxes. The ICO’s most common example of this offence is a staff member who “may have legitimate access to the system” but opens a record without a business reason, like a receptionist looking up family, friends and an ex-partner because she was “just curious” (ICO).
1. It can be a crime, not just a sacking
Under section 170 of the Data Protection Act 2018, it is an offence for a person “knowingly or recklessly” to obtain or disclose personal data without the consent of the controller (the organisation responsible for it), with limited defences such as preventing or detecting crime (legislation.gov.uk). The ICO prosecutes individuals for it, in and outside the NHS:
Car rental: an internal audit at Enterprise Rent-A-Car found a management trainee had come in outside his hours and spent 32 minutes accessing 39 customer records (at least 213 in all). He was dismissed for gross misconduct, pleaded guilty and was fined £265 plus costs (ICO).
Insurance: a former BISL claims adviser accessed 1,550 customer records in 2020, many outside his working hours or while on leave, though his job needed some access. He pleaded guilty and was fined £1,500 in October 2025 (ICO).
Health: an ICO freedom of information response lists more than a dozen prosecutions of NHS staff since 2017 under section 170 or the older section 55 (ICO).
As the ICO put it: “Just because your job may give you access to other people’s personal information, it doesn’t mean you have the legal right to look at it whenever you like” (ICO).
2. Purpose limitation and data minimisation
UK GDPR Article 5 says personal data must be collected for specified purposes and not used in incompatible ways (purpose limitation); be limited to what is necessary (data minimisation); and be kept secure, including against unauthorised processing (legislation.gov.uk). The ICO says you must be clear about your purposes from the start (ICO) and not hold more than you need (ICO). Curiosity isn’t one of your purposes, and less data shown to fewer people means less to look at.
3. Give people only the access their role needs
Least privilege means each person gets the access their job needs, and no more. Set access by role (sales, accounts, HR) rather than person by person, and keep HR and sensitive client files to the few who need them. The NCSC advises reviewing accounts regularly for unnecessary privileges and removing access when it’s no longer needed (NCSC).
4. Review joiners, movers and leavers
The NCSC recommends a “joiners, movers and leavers” policy so access can be revoked when no longer needed, or changed for movers (NCSC). Movers are the ones that get missed: someone who moves from HR to sales can end up keeping both. Check access at each change, and review it all at least quarterly.
5. Log access, and actually review the logs
A log nobody reads protects nobody. In Microsoft 365, Microsoft Purview Audit (Standard) is on by default with the right subscription, keeps records for 180 days, and lets you search by user, activity and date range and export to CSV (Microsoft). For your CRM, HR and case management systems, check whether they record who viewed a record, not just who changed it, and how long they keep that history. Then put a regular check in someone’s diary. In the Enterprise case, an internal audit found the access; in the BISL case, the investigation only began after a law firm passed on customer complaints (ICO) (ICO).
6. Get alerted to unusual record access
Watch for the warning signs in these cases: access out of hours or on leave, lots of records in a short time, or records unrelated to the person’s work. Microsoft 365 alert policies can email named people when chosen activities happen. Alerts based on a threshold or on “unusual” activity need E5 or certain add-ons; on lower plans an alert fires each time the activity happens, so what you can do depends on your licence (Microsoft). Send alerts to someone who will act on them.
7. Clear rules, training and consequences
Write a short acceptable-use policy: only open records you need for the task in hand, and access is logged and checked. The ICO says workers must be told about monitoring in a way that is accessible and easy to understand, and that you shouldn’t monitor “just in case” (ICO). The ICO lists mandatory training, restricting access and auditing systems among ways to reduce breaches (ICO). Make the consequences clear and follow your disciplinary process. At NUH, outcomes ranged from first written warnings to dismissal (NUH).
8. Treat it as a breach: know the 72-hour rule
A personal data breach includes someone accessing data “without proper authorisation”, whether the cause is deliberate or accidental (ICO). If it’s likely to pose a risk to people, you must report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it (UK GDPR Art. 33). The clock starts when you discover it. Record every breach, reported or not, and tell those affected if there’s a high risk to them (ICO) (ICO).
Your access and audit checklist
- Map who can see personal data in each system, including CRM, HR and shared mailboxes.
- Set access by role, with sensitive HR and client data limited to the people who need it.
- Review access on every join, move and leave, and in full every quarter.
- Check audit logging is on and kept long enough, and that it records views, not just changes.
- Review logs regularly and set alerts for out-of-hours or bulk access.
- Write it down and train staff, and agree who reports to the ICO within 72 hours.
Our earlier pieces on stolen logins (ASOS, Nikkei) and supplier risk (Housing Ombudsman) covered outside threats; this one is about insiders.
References
- BBC News, Isaac Ashe, “More NHS staff sacked over Nottingham attacks victims’ records”, 17 October 2026
- NUH NHS Trust, “NUH dismisses further staff in inappropriate access investigations”, 16 October 2026
- NUH NHS Trust, “Nottingham Hospitals confirms first outcomes of inappropriate access investigations”, 21 May 2026
- BBC News, “NHS trust sacks staff over accessing attacks victims’ records”, 21 May 2026
- Sky News, “More NHS staff sacked after accessing medical records of Nottingham attack victims”, 17 October 2026
- NHS England, “NHS staff suspected of snooping on patient records to be immediately suspended”, 25 Sept 2026
- Information Commissioner’s Office, “S170 case considerations” (FOI disclosure IC-558781-X6S6)
- Data Protection Act 2018, section 170 (legislation.gov.uk)
- Information Commissioner’s Office, “Car rental manager fined after unlawfully obtaining customer data”, 16 May 2024
- Information Commissioner’s Office, “Qonain Hussain” (prosecution), 8 October 2025
- Information Commissioner’s Office, FOI response IC-353201-K6Z8 (NHS s170/s55 prosecutions), 24 January 2025
- UK GDPR, Article 5: Principles relating to processing of personal data (legislation.gov.uk)
- Information Commissioner’s Office, “Principle (b): Purpose limitation”
- Information Commissioner’s Office, “Principle (c): Data minimisation”
- National Cyber Security Centre, “10 Steps to Cyber Security: Identity and access management”
- Microsoft Learn, “Learn about auditing solutions in Microsoft Purview”
- Microsoft Learn, “Alert policies in the Microsoft Defender portal”
- Information Commissioner’s Office, “Data protection and monitoring workers”
- Information Commissioner’s Office, “Personal data breaches: a guide”
- UK GDPR, Article 33: Notification of a personal data breach (legislation.gov.uk)
- Information Commissioner’s Office, “72 hours – how to respond to a personal data breach”
Need a hand applying any of this to your business? Get in touch — call +44 1472 564538 or email services@msl.org.uk.