Court staff breached Southport victims’ files, leaving vital questions

Government staff accessed court files on people harmed by the Southport attack despite having no authority to view them — a fresh breach of privacy for families already failed by public institutions.¹

• The Ministry of Justice says unauthorised access to files concerning victims, survivors and families was uncovered during a review of its digital systems; the material included sensitive personal data in a limited number of cases.¹
• The department’s own assessment found the breach was likely to create a high risk to the rights and freedoms of those affected, and it says it is notifying them directly.²
• The Prime Minister has asked the Lord Chancellor to oversee an urgent investigation. HM Courts and Tribunals Service and HM Prison and Probation Service are also examining the breach.¹
• The MoJ says it has found no evidence that information was shared with third parties, but it has not publicly disclosed how many people were affected, which staff accessed the files, whether records were copied, or the outcome of disciplinary action.¹
• The Information Commissioner’s Office has been notified. That is not the same as confirmation of an ICO enforcement investigation.¹

The immediate failure is not a cyber-attack or a lost laptop. It is that staff inside the justice system could open records about child victims, witnesses and bereaved relatives when they had no connection to the case. The MoJ says it is reviewing staff-conduct, acceptable-use and fraud-response arrangements, but it has not explained what controls failed to stop or flag the access sooner.²

Calling this a “high risk” breach matters. ICO guidance says organisations must tell people directly and without undue delay when a breach is likely to pose that level of risk; it specifically warns that breaches involving victims and witnesses can cause serious harm, including loss of confidentiality and wider social disadvantage.³ For the Southport families, reassurance now depends on facts the ministry has yet to publish.

Footnotes

1. ITV News, “Court files about Southport attack victims, survivors and families accessed in data breach”, 16 September 2026 ↩ ↩² ↩³ ↩⁴ ↩⁵

2. Yahoo News, reporting the Ministry of Justice statement, “Data breach relates to Southport attack victims, survivors and families”, 15 September 2026 ↩ ↩²

3. Information Commissioner’s Office, “Personal data breaches: a guide” ↩