Hospital Data Breach Follows Crocodile Attack on Young Boy

On 18 June, a three-year-old boy from Cambridgeshire was seriously injured after being thrown into a crocodile enclosure at Johnsons of Old Hurst zoo near Huntingdon. Zoo staff pulled him from the pit, and he was taken by ambulance to Addenbrooke’s Hospital, part of Cambridge University Hospitals (CUH). Cambridgeshire Police later confirmed the child was “no longer critical” and remained in a stable condition.

BBC NewsThe GuardianBoy's medical records accessed after crocodile attack at zoo

• 13:24 BST (18 June) – Emergency services receive a call reporting the boy’s injuries in the crocodile pit.

The Guardian

• Shortly after – The child is transferred to Addenbrooke’s Hospital for emergency treatment.

Boy's medical records accessed after crocodile attack at zoo

• Later on 18 June – Police arrest a 30-year-old man from Norfolk on suspicion of attempted murder; he is bailed after being deemed unfit for interview.

BBC News

• Following days – Internal logs reveal that up to 40 CUH staff members accessed the boy’s medical records.

The Guardian

• Subsequent to the breach – CUH self-refers the incident to the Information Commissioner’s Office (ICO) and launches an internal investigation.

Boy's medical records accessed after crocodile attack at zoo

CUH employs approximately 13,000 staff. Preliminary findings indicate that roughly 40 employees viewed the child’s records without an immediately clear clinical or operational justification. The hospital has pledged to determine whether each access was legitimate.

BBC News

CUH reiterated its data-protection policies, emphasizing that breaches are taken “extremely seriously” and that any unauthorised access will trigger “robust disciplinary action, including dismissal.” The Trust also confirmed that it will notify the ICO and apologise to affected patients and families. Cambridgeshire Police issued a brief update confirming the boy’s stable condition and the ongoing investigation into the suspect.

Boy's medical records accessed after crocodile attack at zoo

South Cambridgeshire MP Pippa Heylings described the incident as “absolutely unacceptable,” noting that recent NHS data breaches have exposed “weak safeguards.” She called for full transparency from CUH regarding how the breach occurred and what redress will be offered to the victim’s family.

Boy's medical records accessed after crocodile attack at zoo

• “A CUH spokesperson said: “We have strict policies in place to safeguard patient data and we take any breach extremely seriously.” — CUH spokesperson

The Guardian

• “Where any member of staff is found to have accessed patient records without legitimate clinical or operational reasons we take robust disciplinary action, including dismissal.” — CUH spokesperson

The Guardian

• “ Cambridgeshire police said on Monday that the boy was “no longer critical” and was “in a stable condition in hospital”.” — Cambridgeshire Police statement

The Guardian

• “Given recent breaches in patient data protection at other NHS trusts following tragic events, it’s incredibly disappointing to see that safeguards were still too weak here.” — Pippa Heylings, MP for South Cambridgeshire

Boy's medical records accessed after crocodile attack at zoo

Sources differ on the exact time police were first alerted: one report cites 1:24 pm, while another records 13:34 BST. No source identifies the specific staff members who accessed the records, nor does any provide details on the technical means of access. The ICO’s forthcoming findings remain undisclosed.

The Guardian

The ICO will assess CUH’s self-referral and determine whether regulatory action is required. CUH has pledged to complete its internal review, potentially leading to disciplinary measures up to dismissal. Ongoing police inquiries will address the attempted-murder charge against the Norfolk suspect.

Boy's medical records accessed after crocodile attack at zoo