2018 NHS Scotland — TrakCare / health-board data governance failures (~5M patient platform scope)
Data compromised
Patient identifiers, clinical record integrity issues, and board-level PII mishandling per ICO reprimands and FOI allegations
Technical writeup
NHS Scotland’s InterSystems TrakCare electronic health record platform serves on the order of five million Scottish patients across multiple health boards. ICO audit outcomes and Scottish FOI correspondence document recurring data-protection failures from 2017–2018 onward—including NHS Tayside TrakCare integrity issues raised in December 2017 and subsequent board-level reprimands (e.g., NHS Fife patient-data handling). BreachHistory records this as a systemic governance and disclosure row rather than a single attested exfiltration count; June 2026 social and political discourse resurfaced allegations that historic patient-data mishandling on TrakCare-scale systems remained under-reported. Treat the 5M figure as platform population at risk under documented governance gaps, not a verified single-event download.
Root cause
Systemic data governance and TrakCare EHR handling failures across NHS Scotland health boards (2017–2018 era; ongoing ICO scrutiny)