Names and addresses of 224 people exposed in Southampton council data breach
Seven serious data breaches have come to light at Southampton City Council over the last year
Seven serious data breaches by Southampton City Council had to be reported to the independent regulator in the past year.
Incidents included a social worker losing a notebook containing the names, addresses and key safe numbers of 224 individuals, inaccurate information about an individual being shared with police and a council officer accessing information relating to a tenant and sharing it with a family member.
Other breaches involved 167 children’s social care records being destroyed prematurely, 75 missing asbestos reporting forms, a financial assessment provider’s system being compromised and the miscataloguing of around 80,000 social care files.
A report to the council’s governance committee by data protection officer Christ Thornton said actions were taken in response to each incident, which were all deemed sufficiently serious to be reported to the Information Commissioner’s Office (ICO).
The case involving a council officer accessing a tenant’s information was referred to the watchdog as a potential criminal offence may have been committed by the employer.
Mr Thornton’s report said the ICO decided against opening a criminal investigation.
Speaking at the committee meeting on Monday, September 14, he said: “In all cases we work with the ICO as part of their investigations and they were satisfied the mediation measures that we took were adequate.
“As part of those breaches, the Information Commissioner’s Office invited the council to support its Better Care Records campaign, which basically means we have a more proactive approach to creating care records, holding care records and enabling people to have access to their care records.”
During 2025/26, 179 data security incidents were reported to the council’s governance and information team, which was down on the 198 recorded the previous year.
Investigations found 72 per cent of reported incidents were confirmed data breaches, with information being sent electronically to the wrong recipient remaining the most common cause.
No questions were asked about the data breaches at the committee meeting.