Cambridge hospital probes access to boy’s records after crocodile attack

Cambridge University Hospitals is investigating why around 40 people accessed the medical files of a three-year-old boy treated at Addenbrooke’s Hospital after a crocodile attack at Johnsons of Old Hurst near Huntingdon. The trust has referred itself to the Information Commissioner’s Office as it examines whether there were any legitimate reasons for the access.

The boy, from Cambridgeshire, was taken to hospital after the incident on Thursday, 19 June 2026. He was first said to be in a critical condition and later reported to be stable. Cambridgeshire Police said a 30-year-old man from Norfolk was arrested on suspicion of attempted murder and later bailed after being assessed as not being fit for interview.

The case has put a spotlight on a sensitive question inside the NHS: who is allowed to look at a patient’s record, and how well those checks work when a child’s case draws intense curiosity. CUH said it was exploring whether staff members had a proper reason to open the files, but the scale of the access has already raised concerns about privacy safeguards and whether existing penalties deter misuse.

The trust’s handling of information has come under scrutiny before. In December 2023, CUH disclosed a separate breach affecting 22,073 maternity patients at The Rosie Hospital. That incident involved personal data linked to patients booked for care between 2 January 2016 and 31 December 2019, and the data had been exposed through a spreadsheet pivot table.

The Information Commissioner’s Office has also recorded later regulatory action against the trust over freedom of information compliance. In 2025, CUH was the subject of an enforcement notice and was listed as having a backlog of 222 open requests, adding another layer of pressure on an organisation already dealing with questions over how it manages sensitive records.

The ICO says organisations can report breaches to it and that it receives and publishes reports of data security incidents. For CUH, the latest investigation now links a high-profile child protection case with a broader test of whether the NHS can keep intimate medical information properly sealed, even when public attention is at its peak.