Cambridge hospital reports data breach after boy's crocodile attack treatment

Cambridge University Hospitals referred itself to the Information Commissioner's Office after about 40 people accessed the medical records of a three-year-old boy treated at Addenbrooke's Hospital following a crocodile attack at Johnsons of Old Hurst near Huntingdon. The child has not been named, and the trust is checking whether each access had a legitimate reason.

CUH has strict policies to safeguard patient data. Staff who view records without legitimate clinical or operational reasons can face disciplinary action, including dismissal. The ICO can respond to breaches with warnings, reprimands, enforcement notices and penalty notices. The ICO's chief executive has warned that knowingly or recklessly accessing personal data without authorisation can lead to disciplinary action, loss of professional accreditation and prosecution in some cases.

Officers were called to Johnsons of Old Hurst at 1.24pm on Thursday, June 19, 2026, and were at the scene by 1.34pm. The boy sustained serious injuries while in the crocodile enclosure and was pulled out by zoo staff before being taken to Addenbrooke's Hospital, where he is now stable; specially trained officers are supporting his family there.

A 30-year-old man from Norfolk was arrested on suspicion of attempted murder and later released on bail after he was assessed as not being fit for interview. Investigators do not believe the man and the child knew each other, and Cambridgeshire County Council could not comment further because the case remains a live police investigation.