Natural Resources Wales Data Breach Exposes Employee Diversity Information

Natural Resources Wales (NRW) has reported a personal data breach involving sensitive diversity-monitoring information of former and current employees. The breach affected individuals employed between April 2013 and March 2018. An internal investigation revealed that a spreadsheet containing employee data was accidentally published online, making the information accessible. The disclosed data may include personal details related to ethnicity, disability status, religion, sexual orientation, and other equality monitoring information. NRW has taken steps to contain the incident, including removing the data from the website and reporting to the Information Commissioner’s Office (ICO). While there is no evidence of misuse, NRW advises affected individuals to remain vigilant for unexpected communications. The organization is reviewing its processes to prevent future incidents.

Key Points: • NRW reported a data breach affecting employee diversity information from 2013-2018. • A spreadsheet containing sensitive data was accidentally published online. • NRW has taken steps to mitigate the breach and is cooperating with the ICO.