UK ambulance data breaches surge past 4,000 in three years

UK ambulance services recorded more than 4,000 data breaches over the past three years, according to figures obtained through Freedom of Information requests.

The data points to a sustained rise in reported incidents across the period. Official figures show ambulance services recorded 1,212 data breaches in 2022/23. The total rose to 1,460 in 2023/24. In the most recent year covered, ambulance services logged 1,521 breaches.

Ambulance services process medical and personal information as part of emergency response. This includes details provided during 999 calls, notes recorded at incident scenes, and information shared with hospitals. These organisations also handle contact information for patients and their families.

The figures come as emergency services face growing exposure to cyber and digital risks. Connectivity across systems and increasing use of digital tools has expanded the volume of data held by public services. It has also increased the number of potential failure points in day-to-day handling, storage and transfer of information.

Where breaches occur

The FOI data also identified which ambulance services reported the highest number of incidents across the three-year period. London Ambulance Service recorded 904 breaches. East of England Ambulance Service reported 716 incidents.

The figures do not break down the root cause of each incident in the summary provided. The release said cyberattacks often attract the most attention. It also said many incidents arise from routine causes. These include human error, IT system failures and the loss of devices containing personal data.

Data incidents can affect patients, staff and third parties such as relatives or carers. Ambulance services often operate across multiple sites and vehicles. Staff work under time pressure. They also rely on mobile devices, communications systems and digital records. Those conditions increase the need for clear handling processes and oversight of access to information.

Cybersecurity backdrop

The disclosure also sits alongside broader warnings about cyber threats to emergency services. The release cited research from NCC Group. The research warned of escalating digital threats to blue light services. It said ransomware attacks rose 15% during 2024.

Ransomware incidents can affect the availability of systems. They can also disrupt communications and access to records. In emergency care settings, disruption can affect response times and operational co-ordination.

The FOI figures relate to recorded breaches rather than confirmed cyberattacks. The underlying incidents can range from unauthorised access to misdirected communications, missing paperwork, lost devices, and system configuration errors. The release did not provide a detailed breakdown by type of breach.

Ambulance services form part of the wider NHS information environment. The NHS has moved towards wider use of digital patient records. Trusts also exchange information with hospitals and other care providers. That flow of data increases the need for consistent controls across organisations.

Legal exposure

Solicitors say the nature of ambulance work raises the stakes when a breach occurs. "Ambulance services handle some of the most sensitive personal data that exists, including medical records, emergency care notes and contact details for patients and their families. When that information is mishandled, lost, or accessed without authorisation, the consequences for those affected can be extremely distressing," said Tekena Bobmanuel, Data Breach Solicitor, JF Law.

The release also drew attention to the rights available under UK data protection law. "Many people wrongly assume that a data breach is something they simply have to accept, particularly when it involves a public service," said Bobmanuel.

"In reality, UK data protection law gives individuals the right to seek compensation if a failure to protect their personal data has caused emotional harm, anxiety or financial loss.

"Claiming compensation is about accountability and ensuring that appropriate safeguards are in place to protect highly sensitive information. Where mistakes occur, affected individuals should be made aware of their rights and supported in taking action if they have suffered as a result."

The rising number of recorded breaches could reflect several factors, including changes in reporting practice, internal awareness and resourcing, as well as the volume of data handled through digital channels. The release did not set out whether reporting thresholds or definitions changed during the period.

Ambulance services continue to digitise records and communications as part of NHS operations. The data suggests that information governance and operational resilience will remain a focus for trusts as they manage clinical workloads alongside growing cyber and data handling risks.