Forty-eight staff members at University Hospitals of Liverpool Group improperly accessed the medical records of victims injured in the Southport attack, according to an internal audit conducted shortly after the incident. The unauthorized access came to light this week, causing distress among survivors and raising questions about the hospital trust’s handling of patient confidentiality.

The attack occurred in July 2024 when Axel Rudakubana targeted a Taylor Swift-themed dance workshop at the Hart Space in Southport. Three children—Bebe King, six; Elsie Dot Stancombe, seven; and Alice da Silva Aguiar, nine—were killed, while ten others were injured. Several of the injured were treated by the University Hospitals of Liverpool Group.

Leanne Lucas, an instructor at the workshop who survived the attack, expressed her devastation upon learning that 48 staff members accessed victims’ records without legitimate reason. “I am absolutely devastated and horrified that my privacy has been invaded when I was at my most vulnerable,” she said. While acknowledging her gratitude toward the medical teams who saved her life, Lucas condemned what she described as an abuse of trust by hospital employees.

Nicola Brook, legal director at Broudie Jackson Canter, which represents three survivors including Lucas at the ongoing Southport inquiry, described the scale of the unauthorized access as indicative of a wider cultural problem within the trust. “This is more than a few bad apples... it was 48 different members of staff who, for no legitimate reason, chose to access vulnerable victims’ records,” she stated. Brook emphasized that meaningful change would require accountability and consequences for those involved.

University Hospitals of Liverpool Group notified the Information Commissioner’s Office (ICO) of the breach in August 2024. Trust Chief Executive James Sumner explained the decision not to inform patients until recently, citing concerns over the potential psychological impact on victims. “We are sincerely sorry for any distress that may have been caused to the patients who trusted us to look after them when they were most vulnerable,” Sumner said. He reaffirmed that breaches of patient confidentiality undermine the efforts of dedicated care teams and assured that all staff implicated faced human resources disciplinary procedures.

Rudakubana was sentenced to a minimum of 52 years in prison for the murders of the three children and the attempted murders of eight others, including Lucas and a businessman named John Hayes. The attack and its aftermath have prompted a wider review of safeguards around patient data and highlighted the importance of stringent controls to maintain confidentiality in sensitive cases.