ScrubDrop › Guides

The PSNI, Hammersmith & Fulham and Cambridge Hospitals leaks all came from one thing: hidden Excel data in FOI replies

Last updated: 30 September 2026

Police Service of Northern Ireland, August 2023

The Information Commissioner's penalty notice sets out the sequence in detail. A request arrived through WhatDoTheyKnow asking for the number of officers and staff at each rank or grade. A member of the workforce planning team prepared the figures from an Excel file downloaded from the HR system, which held a single worksheet named "SAP DOWNLOAD" with the surname, initials, role, rank, department, location and service number of every officer and member of staff. The analysis was done in further worksheets in the same file, with a "Return" worksheet holding the answer.

Before sending, the preparer deleted all the tabs visible on their screen apart from the Return tab. They did not realise that more worksheets existed than were shown: a small set of three horizontal dots to the left of the remaining tab indicated that "SAP DOWNLOAD" was still in the workbook. The quality-assurance check that followed looked at the only visible tab and confirmed its figures were right. The file was uploaded to WhatDoTheyKnow at 14:31 on 8 August 2023 and, according to the notice, the worksheet was publicly accessible for approximately 2 hours and 20 minutes.

The ICO's announcement of 3 October 2024 gives the outcome: a fine of £750,000 for exposing the personal information of all 9,483 officers and staff, a figure the ICO says would have been £5.6 million had its approach to public-sector fines not been applied.

Worth noticing: the ICO writes "hidden" in quotation marks. The worksheet had not been hidden in Excel's sense; it was simply off-screen. No hiding feature was needed for it to go unnoticed.

London Borough of Hammersmith & Fulham, October 2021

The reprimand dated 16 May 2025 says the council's reply to an FOI request, also made through WhatDoTheyKnow, was published on 7 October 2021 and "contained a series of 35 hidden workbooks", with personal data in areas of 10 of them. WhatDoTheyKnow told the council on 20 November 2023. The ICO's news release puts the total at 6,528 people, 2,342 of them children, including 96 unaccompanied asylum-seeking children.

Among its findings, the ICO noted that the council had not told staff to use Excel's Inspect Workbook tool before disclosure, or to convert spreadsheets to CSV. Its recommendations, which the reprimand says are not legally binding, include making it mandatory for material prepared for disclosure to be reviewed by a peer or manager before release.

Cambridge University Hospitals, 2020

We could not find an ICO reprimand, penalty or news release about this incident on ico.org.uk. The ICO's disclosure log records a July 2026 request for details of a personal data breach reported by the trust, answered with information partially withheld; it does not say which breach. So what follows comes from the trust's own statement of 6 December 2023, not from the regulator.

The trust says that in 2020 it answered an FOI request made through WhatDoTheyKnow with a spreadsheet whose personal data was "not immediately visible" but could be reached through a pivot table. It covered 22,073 maternity patients of The Rosie Hospital between 2016 and 2019, including names, hospital numbers and birth outcomes, and was publicly available from 18 November 2020 to 1 November 2023. A search after that discovery found a second spreadsheet, sent in 2021 in answer to a request from a company, with the names, hospital numbers and some medical information of 373 patients on cancer clinical trials; the trust says that one was never public. It reported both to the ICO.

Three mechanisms, one cause

A worksheet out of view, worksheets marked hidden, and a pivot table's cache are different things inside the file. The PSNI notice describes all of them: Excel files can hold worksheets not shown as tabs, worksheets, rows and columns can be deliberately hidden, and "the underlying data used to generate a pivot table can be embedded in the pivot table as hidden data", which it notes can be reached by double-clicking the pivot table.

What the three cases share is simpler. The file sent out was the working file. Each time, someone checked that the visible answer was right — and it was.

What the guidance now says

• The ICO's advisory note to public authorities (September 2023) called for a moratorium on disclosing original source spreadsheets to online platforms in response to FOI requests, and for converting them to formats such as CSV.
• The Cabinet Office's guidance on communication by spreadsheet (updated 14 December 2023) expects any disclosure by spreadsheet to be tested for hidden material by people with the technical capability to do so, and reviewed by two separate individuals before it is sent.
• The ICO's current guidance, on hidden information in spreadsheets, warns that Document Inspector "cannot identify when personal information is hidden in remote rows and columns" — data simply placed far from the visible area.

When Office's own tools are enough

If the answer to a request is a table of numbers, the simplest control is the one the ICO and Cabinet Office both name: send it as CSV. The ICO's spreadsheet guidance suggests converting to a simpler format like CSV precisely because it brings hidden information into view. The PSNI notice records that Excel reminds you, when exporting to a text file, that only the current worksheet will be saved — the other sheets stay behind. Open the CSV in a text editor before sending and read all of it.

When the requester has asked for a spreadsheet, or the file has to stay a workbook, you need to check the workbook itself.

Where ScrubDrop fits

ScrubDrop is a pre-send audit of the hidden data in an .xlsx, .docx or .pptx file. It reads the file in your browser — nothing is uploaded — and lists what it finds, free, in every category it knows: hidden and very hidden sheets, hidden rows and columns, pivot caches, links to other files, defined names, comments, document properties and more. It also points out white or tiny text and cells outside the print area, which it reports but does not remove.

To remove what it found, it rebuilds the workbook from the parts it knows are needed and then opens the result again with different parsers to check that the categories you removed are really gone; a file that fails that check is not offered for download. The free version removes properties, comments and tracked changes; hidden sheets, pivot caches and the other structural categories are removed in ScrubDrop Pro. When hidden sheets, rows or columns, defined names or links to other files are removed, every formula on the sheets that stay becomes its last calculated value.

It does not decide whether the visible numbers are disclosable, and it does not read text inside images. The re-check is a strong signal, not a promise: open the cleaned file and look at every sheet before it goes out.

How to check this yourself

1. Work on a copy. Right-click any sheet tab: if Unhide is available, there are hidden sheets (this check is from the government's "Hidden data" leaflet). Sheets hidden as "very hidden" do not appear in that list, as Microsoft notes.
2. Look for the dots or arrows beside the sheet tabs and scroll through every tab: that is how the PSNI's extra worksheet went unseen.
3. On every sheet, look for gaps in the row numbers and column letters, which the leaflet gives as the sign of hidden rows and columns. Then scroll well beyond the visible table in both directions, because data placed far away is not hidden at all and Document Inspector will not report it.
4. Find every pivot table and ask whether the recipient needs the pivot table itself or only the figures it shows.
5. On Windows, run File › Info › Check for Issues › Inspect Document (Microsoft's instructions). The PSNI notice adds a caveat: it would not have flagged worksheets that are merely out of view.
6. Check the file size. The ICO's spreadsheet checklist suggests watching for files larger than you would expect.

Questions