Summary
- A maternity database was overwritten after pre-written instructions intended for a different hospital database were run with an incorrect setting.
- Nottinghamshire Police says no crime has currently been identified and analysis of the technical process remains under way.
- The incident puts change control, recoverability, and protection of operational data under scrutiny without evidence of a hostile cyberattack.
Police are investigating the circumstances surrounding the overwrite of a maternity-records database at Nottingham University Hospitals NHS Trust after an error during routine technical work caused instructions intended for another hospital system to run against the wrong database.
Nottinghamshire Police said the incident occurred on 18 August while a copy of a radiotherapy database was being created for reporting purposes. A set of pre-written computer instructions that had previously been used for a different hospital system was reused, but a setting that should have been changed was missed.
The process consequently ran against a maternity database rather than the intended radiotherapy system and overwrote maternity records.
The trust informed police on 4 September. Officers attended on 7 September as part of Operation Perth, an ongoing investigation connected with maternity services at the trust.
Police are examining exactly what occurred, why it happened, whether any criminal offence may have been committed, what data has been lost, and whether remaining copies can be recovered. As of the latest update, Deputy Chief Constable Rob Griffin said no crime had been identified.
The force is awaiting a copy of the database before further recovery attempts can be made. The impact on Operation Perth also remains under assessment.
The known facts therefore do not support describing the event as a cyberattack or hostile intrusion. The current account instead points to an operational technology failure involving scripts, configuration, and change execution — an important distinction when assessing both accountability and remediation.
Such incidents can nevertheless produce consequences comparable with malicious data destruction. A database overwritten by an administrative error can become unavailable or incomplete regardless of whether the destructive action originated from an attacker, faulty software, or authorised technical work.
Recovery controls are what separate a damaging mistake from a lasting loss. Database copies, immutable backups, replication, transaction logs, tested restoration procedures, and controls over destructive operations can all affect the outcome, although police have not yet published enough technical detail to establish which protections were present at NUH or why recovery remains uncertain.
The reuse of pre-written instructions also puts procedural safeguards under scrutiny. Automation and scripted administration reduce repetitive manual work, but the consequences of a wrong environment variable, database name, connection string, or deployment target can scale quickly when privileged commands are executed against production data.
High-consequence environments such as healthcare add another layer. Clinical and maternity information can support care, investigations, regulatory duties, and communication with affected families. Its value persists long after the original clinical encounter, meaning retention and recoverability are part of operational resilience rather than merely IT housekeeping.
The police investigation is examining potential criminality, but its latest statement explicitly says none has yet been identified. That caveat is important while technical analysis continues.
The incident also demonstrates why cyber resilience should not be defined only through external threat actors. Organisations can lose critical data through legitimate credentials, authorised administration, and ordinary technical processes. The controls needed to withstand those events — segregation, change management, recoverable backups, audit trails, and tested restoration — overlap substantially with controls used to limit damage from ransomware or malicious insiders.
Further conclusions will depend on the recovery work and the investigation into the process that was run. Until then, the confirmed failure is an accidental overwrite during routine technical activity, not a proven security compromise.
