> series: anatomy_of_a_breach —— part: 022 —— target: nhs_brighton_sussex —— hard_drives: 252 —— sold_on: ebay —— fine: £325,000<span class="cursor-blink">_</span>_
Between October and November 2010, 252 hard drives decommissioned by Brighton and Sussex University Hospitals NHS Trust were sold on eBay. The drives contained tens of thousands of patient records — names, addresses, dates of birth, NHS numbers, medical histories, and detailed clinical information. The Trust had contracted a data destruction company to securely destroy the drives. The contractor did not destroy them. Instead, they sold them as second-hand storage devices on eBay.
The breach was discovered when a member of the public purchased drives from eBay and found patient data intact. The ICO's investigation confirmed that the Trust had failed to adequately oversee the contractor's destruction process — there was no verification that the drives had actually been destroyed, no audit trail, and no certificate of destruction obtained for individual devices. The ICO imposed a fine of £325,000, its largest NHS penalty, which the Trust initially challenged (claiming it could not afford the fine) before settling at a reduced £260,000.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThis breach was not caused by a hacking attack, a software vulnerability, or a configuration error. It was caused by a failure of supply chain oversight — the Trust outsourced data destruction to a contractor and did not verify that the destruction actually occurred. The contractor, instead of shredding or degaussing the drives as contracted, sold them for profit on eBay with patient data intact.
For any organisation handling sensitive data — patient records, financial information, personnel files — the secure disposal of hardware containing that data is a security control that requires the same rigour as any other control: documented procedures, technical enforcement (encryption, degaussing, physical destruction), verification that the control operated effectively, and audit trails that provide evidence.
Cyber Essentials certification addresses device security including secure disposal. Our infrastructure assessments review data disposal procedures and supply chain oversight. For healthcare organisations, the DSPT expects evidence of secure disposal practices. SOC in a Box for Healthcare provides ongoing monitoring of your active systems, while our assessment services verify that your decommissioning procedures protect data after systems are retired. For incident response when improperly disposed data is discovered, UK Cyber Defence provides forensic investigation.
Our <a href="/penetration-testing/infrastructure">security assessments</a> include data disposal procedure reviews. <a href="/cyber-essentials">Cyber Essentials</a> establishes baseline device security. Because paying someone to destroy your data is not the same as verifying that they did.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call