Cornwall Council

Cornwall Council experienced a data breach where personal details of multiple children, including their home addresses, were mistakenly sent to unrelated individuals via email. The incident involved school transport assistance records being dispatched to incorrect recipients, exposing sensitive information. The council issued an apology to affected parents and confirmed a full internal investigation is underway to determine the cause and prevent recurrence. While the breach was described as rare, it highlights vulnerabilities in the council’s data-handling procedures, particularly in safeguarding minors' personal information. No evidence of malicious intent or further exploitation of the leaked data has been reported, but the incident has raised concerns among parents and stakeholders about data security protocols within the local authority.

Source: https://www.bbc.com/news/articles/crl51ky0ll1o?at_medium=RSS&at_campaign=rss

TPRM report: https://www.rankiteo.com/company/cornwall-council

"id": "cor5032350092925",
"linkid": "cornwall-council",
"type": "Breach",
"date": "9/2025",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': 'Multiple children (pupils) and '
                                              'their parents',
                        'industry': 'Public Administration / Education',
                        'location': 'Cornwall, UK',
                        'name': 'Cornwall Council',
                        'type': 'Local Authority / Government'}],
 'customer_advisories': ['Notification to affected parents'],
 'data_breach': {'file_types_exposed': ['Emails'],
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': "High (includes children's personal "
                                        'information)',
                 'type_of_data_compromised': ['Personal details (home '
                                              'addresses)',
                                              'School transport assistance '
                                              'records']},
 'description': 'A local authority data breach at Cornwall Council resulted in '
                'the personal details of multiple children, including their '
                'home addresses, being sent to the wrong recipients via email. '
                'The breach involved school transport assistance '
                'communications. The council apologized, stated it takes data '
                'protection seriously, and is conducting a full internal '
                'investigation to prevent recurrence.',
 'impact': {'brand_reputation_impact': 'Apology issued; council emphasized '
                                       'rarity of such incidents',
            'customer_complaints': 'Parents expressed concern',
            'data_compromised': ['Personal details of children (including home '
                                 'addresses)',
                                 'School transport assistance information'],
            'identity_theft_risk': 'Potential (due to exposure of personal '
                                   'details)',
            'systems_affected': ['Email system']},
 'investigation_status': 'Ongoing (full internal investigation)',
 'post_incident_analysis': {'corrective_actions': ['Process review to prevent '
                                                   'email misdelivery']},
 'references': [{'source': 'BBC News (or original article source)'}],
 'regulatory_compliance': {'regulations_violated': ['UK GDPR (potential '
                                                    'violation due to '
                                                    'unauthorized disclosure '
                                                    'of personal data)']},
 'response': {'communication_strategy': ['Public apology',
                                         'Statement to concerned parents'],
              'incident_response_plan_activated': True,
              'recovery_measures': ['Establishing how the error occurred',
                                    'Ensuring it cannot happen again'],
              'remediation_measures': ['Full internal investigation']},
 'stakeholder_advisories': ['Apology to parents', 'Public statement'],
 'title': "Cornwall Council Data Breach: Pupils' Personal Details Sent to "
          'Strangers',
 'type': 'Data Breach (Human Error / Misdelivery)',
 'vulnerability_exploited': 'Human error (email misdelivery)'}