2026 NHS Forth Valley — maternity spreadsheet to staff personal email; ~150 women (FVRH)
Data compromised
Per NHS and patient reports: names, dates of birth, postcodes/addresses, NHS numbers, maternity treatment details, and number of children—field mix varied by individual; spreadsheet majority described as unidentifiable with identifiable lines for women who accessed local maternity services
Technical writeup
Verified insider data breach — disclosed July 9, 2026. NHS Forth Valley told the Falkirk Herald it is investigating after a member of staff in the women and children's unit at Forth Valley Royal Hospital in Larbert transferred a spreadsheet containing an extract of maternity-system data to a personal email address. The board said that while most lines in the spreadsheet were unidentifiable, it contained some data relating to women who had accessed local maternity services—about 150 patients per reporting and affected-patient correspondence signed by director of midwifery Mairi McDermid. Patient accounts described fields including full names, dates of birth, addresses, NHS numbers, pregnancy treatment details, and number of children. NHS Forth Valley stated there is no evidence the information was shared more widely at this stage and that the employee advised they deleted the data; the board could not say with certainty whether copies remain or were shared elsewhere. Affected women were contacted directly; the UK Information Commissioner's Office received a report and was making enquiries. NHS Forth Valley said the matter was reported to Police Scotland, though local officers told the Herald they had no knowledge of the incident at publication time. The spokesperson declined to say whether the employee was suspended or subject to disciplinary action.
Root cause
Women and children's unit employee at Forth Valley Royal Hospital downloaded a spreadsheet extract from the maternity system and transferred it to a personal email account; NHS Forth Valley internal investigation underway