The Information Commissioner's Office (ICO) investigation led to the criminal conviction of a Herefordshire Council employee for unauthorized access to personal data.

An employee of the council's Children and Young People Directorate accessed approximately 490 records without authorization and downloaded 94 documents over a four-day period. The records concerned family members and acquaintances, including children and adults. The accessed information contained highly sensitive data, such as medical records, social worker reports, and family and child assessments. The discovery of this activity followed internal concerns about unauthorized access to a referral record.

The employee pleaded guilty on 27 May 2026 to an offense under section 1 of the Computer Misuse Act 1990. On 17 July, Worcester Magistrates' Court sentenced him to two months' imprisonment suspended for 12 months, with 120 hours of unpaid work. He was also ordered to pay £2,000 in costs and a £154 compensation surcharge. The ICO's head of investigations described the case as "particularly serious" due to the sensitive nature of the information and its "systematic misuse."