The NHS University Hospitals of Liverpool Group (UHLG) has admitted that almost 50 staff members improperly accessed the medical records of victims from the Southport knife attack in July 2024.

Among those affected were a 13-year-old girl and adult teacher Leanne Lucas, who was seriously injured in the attack that left three young girls dead and eight children wounded.The breach occurred at Aintree Hospital in Liverpool shortly after the attack and was discovered through a routine information access audit.Victims were only informed nearly two years later, following media inquiries.The trust stated that staff involved faced disciplinary measures, from informal counselling to written warnings, but no dismissals were made.Victims and their legal representatives criticised the delay in notification, describing it as a severe violation of privacy and a betrayal of trust.MPs and health officials expressed concern, stressing that such breaches undermine patient confidence.

UHLG claims the delay in informing patients was on clinical advice to avoid psychological harm, and improvements have been introduced to prevent future inappropriate access.

The Information Commissioner's Office continues to emphasise the importance of data security but is not launching a criminal investigation at present.