Info Gov

Eleven members of staff have been dismissed by Nottingham University Hospitals NHS Trust for inappropriately accessing the medical records of the Nottingham attack victims.

The Trust today (21 May) confirmed that 11 members of staff have been dismissed, with actions being taken against another 14, as part of their investigation into the inappropriate access of the medical records of Ian Coates, Grace O'Malley- Kumar and Barnaby Webber.

The three victims were stabbed to death on 13 June 2023 by Valdo Calocane, who was diagnosed with paranoid schizophrenia in 2020.

Staff included in the investigations were doctors, nurses, registered medical professionals and admin and clerical colleagues.   

The Trust noted that follow-up activity will now take place with relevant independent regulators, such as the Nursing and Midwifery Council and General Medical Council. 

It added that it has informed the Information Commissioner’s Office (ICO) and Nottinghamshire Police.   

Dr Manjeet Shehmar, Medical Director at Nottingham University Hospitals NHS Trust, said: “The families of Ian, Grace and Barnaby have had to endure much pain and heartache, and I am truly sorry that the actions of some of our staff have added to that.  

"To access the medical records of our patients without a legitimate reason is totally unacceptable and we are doing all we can to identify where and how that has happened. I hope that the families, staff and our communities feel reassured by the outcomes so far, that we are taking this seriously and will continue to do so.  

“We know that the vast majority of our staff understand that appropriate access is a fundamental principle of our duty of care and know that it is essential that access to patient records is lawful, justified, and directly related to their role. By accessing records inappropriately, staff are damaging the valuable contributions made by those colleagues providing care for those patients. In those cases where it does  happen, I hope that this is a very clear reminder that we will take appropriate action.”

Further investigations are ongoing into inappropriate access, including into the files of surviving victims, including Wayne Birkett, Sharon Miller and Marcin Gawronski.

Dr Manjeet Shehmar will be giving evidence in May 2026 on the investigations at the Nottingham Inquiry - the ongoing public inquiry into the attacks in June 2023.

Lottie Winson

Also in this section

Sep 11, 2026

Anthropic discloses fourth incident of AI model attacking real systems and hands investigation to independent evaluation organisation

Anthropic has published details of four incidents in which its Claude models gained unauthorised access to real third-party systems during cybersecurity evaluations, downloading and modifying user records at a real company, reading the personal information of an individual, harvesting credentials and accessing a security vendor's live database, after the test environments were mistakenly…
Sep 10, 2026

Welsh environmental watchdog hit by data breach

Environmental regulator Natural Resources Wales (NRW) has reported itself to the Information Commissioner's Office after a data breach saw personal details of staff made public.
Aug 24, 2026

Ministers seek power to ban tech risky vendors from critical sectors and bar recipients from discussing the order

The government has tabled amendments to the Cyber Security and Resilience (Network and Information Systems) Bill that would allow the Secretary of State to direct operators of essential services, data centres, managed service providers and other designated organisations to stop buying from, restrict the use of, or remove and disable products from a named vendor on national security grounds, with…
Aug 12, 2026

ACRO Criminal Records Office reprimanded by ICO following cyber security failings

The Information Commissioner's Office (ICO) has urged organisations to strengthen “patching and security monitoring processes” after cyber security failings at ACRO Criminal Records Office left the personal information of up to ten-thousand people, including some individuals’ sensitive data, potentially exposed.
Aug 06, 2026

AI agents sent malicious files to real developers and planted prompt injections in unmonitored test: AISI

The AI Security Institute (AISI) has published an incident report disclosing that AI agents under evaluation in its research environment took sustained, unsanctioned action against real people and organisations on the live internet, including researching the human maintainers of an open-source project, creating fake online identities to pressure one of them into approving malicious code, and…
Aug 05, 2026

Third AI platform goes rogue during cyber testing

The AI Security Institute (AISI) has reveaked a security incident in which AI agents being evaluated for their cyber capabilities took sustained, unsanctioned action directed at real people and organisations, including an attempted supply-chain attack on a publicly used open-source software project.

InfoGov Masthead Newsletter 800