Natural Resources Wales (NRW) has disclosed a personal data breach involving a spreadsheet with sensitive diversity-monitoring information belonging to former and current employees.
The organization said the incident affects people employed between April 2013 and March 2018, creating a privacy issue because the dataset may have contained special-category information under UK data-protection law.
NRW said the spreadsheet was inadvertently published, not exposed through a confirmed intrusion, and stressed that not every data category applied to every affected person.
Natural Resources Wales Data Breach
The agency notified the Information Commissioner’s Office and is examining the circumstances and controls behind the disclosure.
According to NRW, the exposed fields included ethnicity, disability status, religion or belief, sexual orientation, Welsh language ability, caring responsibilities, and other equality-monitoring information.
These data elements can reveal aspects of an individual’s identity and, if obtained by malicious parties, could be used for targeted phishing, impersonation, harassment, discrimination, or social-engineering campaigns.
Even without credentials, workforce demographic records may allow an attacker to craft messages that exploit personal circumstances.
The disclosure raises concerns about copying, caching, and screenshots, although NRW said it has received confirmation that the published material has been permanently deleted.
NRW said it acted immediately after becoming aware of the issue. Its response included removing the information from the website, securing confirmation of deletion, and reviewing published material for exposure risks.
The incident was reported to the ICO in line with its obligations. The notification does not indicate when the spreadsheet was published, how long it was accessible, how many people were affected, or whether it was indexed by search engines.
Those unanswered questions are important for assessing exposure, the scope of notification, and whether parties copied the data before removal.
The organization said it currently has no evidence that the information has been misused. Nevertheless, staff should handle unexpected messages, requests for details, and HR communications with caution.
An attacker with access to equality data could tailor lures around networks, care responsibilities, language skills, services, or identity-related themes. Recipients should verify contact through NRW channels, avoid opening links or attachments, and report activity promptly.
They should preserve emails, messages, and screenshots where possible to assist the investigation. NRW encouraged individuals to report concerns while it continues reviewing safeguards to prevent recurrence.
This incident illustrates a failure: sensitive data can be exposed without malware, ransomware, or a network compromise when publication workflows, access controls, and data-governance checks fail.
Organizations handling employee records should apply data minimization, restrict access to need-to-know users, encrypt files, and use approval gates before content is published.
They should scan sites for spreadsheets, maintain asset inventories, and use data-loss-prevention controls that flag fields.
For NRW, the investigation needs to determine the publication path, exposure window, affected population, and whether logs can establish who accessed the file. Transparent updates remain essential for restoring trust.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
 has disclosed a personal data breach involving a spreadsheet with sensitive diversity-monitoring information belonging to former and current employees.){kind=link}