Southport survivor says NHS failed to disclose data breach as MoJ staff also snooped

A Southport attack survivor has said hospital bosses failed to tell her that her records had been accessed inappropriately. Leanne Lucas, a dance teacher who was stabbed in the July 2024 attack, believes the NHS trust hoped the data breach would never come out. She is among a number of victims whose details were read by dozens of NHS staff without a proper reason.

Her intervention comes after it emerged that victims, survivors and witnesses of the Southport stabbing attack had their court records accessed by Ministry of Justice staff. An audit was carried out after the attack. It found that personal details of some of those affected had been accessed by staff with no connection to their case. The disciplinary action involving those staff finished in April this year. It is not known how many staff were involved or how many kept their jobs.

The Prime Minister was notified in August, before the affected families and survivors were told. The Prime Minister then instructed the Chancellor to carry out another investigation. The families were informed only recently. The Ministry of Justice has apologised. It said it was appalled and recognised the distress caused. It said unauthorised access to court files was completely unacceptable and was being investigated urgently. The Prime Minister has asked the Lord Chancellor to oversee the matter, and the department promised extremely firm action.

In an interview, Ms Lucas said the longer the delay went on, the worse it got. She said she did not understand why it had taken so long unless people were trying not to let the information out. Asked if it was a cover-up, she said she honestly did not know. She said there had been plenty of time during the court case and inquiry for people to admit what had happened, but they may have thought it would go under the carpet because there was so much else going on.

She called for real regulations, policies and potentially legislation. She said anyone who repeatedly opened someone else's files should not be allowed to work in that role. She also urged other victims to come forward and stand together.

A spokesperson for NHS University Hospitals of Liverpool Group said it was sincerely sorry for any distress caused to patients under its care who trusted it when they were most vulnerable. The trust said that when it concluded its investigation it obtained clinical advice and decided not to inform the patients involved, taking into consideration the potential psychological impact at the time.

The Southport case is not the only data breach under scrutiny. Earlier reporting revealed that tens of thousands of patient records had been accessed inappropriately, including records linked to the Nottingham attack. In May, Liverpool Hospital Trust admitted that nearly 50 staff had inappropriately accessed the records of victims treated at Aintree Hospital. Northwest Ambulance Service has also been investigating.

The breaches have raised wider concerns about who can see sensitive records and why. The issue is not limited to high profile victims. Thousands of ordinary people have had their records looked at by strangers, whether through morbid curiosity or a more serious motive such as blackmail. There are calls for stricter access controls so that only staff providing direct care or working directly on a case can open a person's file. The cases have also raised questions about public trust as more records are digitised, including through the NHS app.