New figures have revealed that South Western Ambulance Service NHS Foundation Trust has paid more than £30,000 in compensation to people affected by data breaches over the past three years.
The data, obtained by Data Breach Claims UK, highlights how information security failures continue to impact ambulance services at a time when emergency responders are working to strengthen digital systems amid rising cyber threats.
Ambulance crews routinely handle highly sensitive personal information — from medical details shared during 999 calls to observations made at the scene and patient records passed to hospitals. The fast‑paced nature of emergency work, combined with increasing reliance on digital tools, means the risk of data breaches remains a significant concern.
In 2022/23, the Trust recorded five data breach incidents, a figure that remained the same the following year. More recent figures show a slight improvement, with three breaches reported over the past 12 months, though experts say continued vigilance is essential.
The findings come as cybersecurity specialists warn of growing threats to emergency services. Earlier this year, NCC Group reported a 15% rise in ransomware attacks in 2024, noting that such incidents can severely disrupt blue‑light operations.
Data breach solicitor Tekena Bobmanuel, from JF Law, said ambulance services deal with “some of the most sensitive personal data that exists,” adding that mishandled or wrongly shared information can be “extremely distressing” for those affected.
Freedom of Information responses show that the most common causes of breaches within South Western Ambulance Service were emails sent to the wrong recipient (four incidents) and failures to properly redact information (three incidents). Other breaches stemmed from human error, IT faults and the loss of devices containing personal data.
Since 2022, nine compensation claims have been brought against the Trust, resulting in £32,375 being paid to successful claimants.
Mr Bobmanuel said many people wrongly assume they cannot challenge a public service over a data breach, adding that UK law gives individuals the right to seek compensation where emotional harm, anxiety or financial loss has occurred.
A spokesperson for South Western Ambulance Service NHS Foundation Trust told Burnham‑On‑Sea.com that the organisation “takes its responsibilities under data protection legislation extremely seriously.”
They said: “Between 2022 and 2025, the Trust reported a small number of data breaches to the Information Commissioner’s Office in line with statutory requirements. Each incident was thoroughly investigated and, where appropriate, actions were taken to strengthen our controls and reduce the risk of recurrence. We apologise unreservedly for these incidents and for any concern they may have caused.”
The Trust said it operates a comprehensive information governance framework, including mandatory staff training, defined reporting procedures and regular monitoring of information security risks.
“We remain committed to maintaining the highest standards of data security and to the continuous improvement of our practices, ensuring we safeguard the information entrusted to us,” the spokesperson added.
