A redesign of a genuine post-incident review — eleven real public-sector data breaches, each written up separately, when the report's own findings had already named the three causes most of them shared.
A post-incident review earns its keep by finding what's shared across cases, not by documenting each case in isolation. This report did that analytical work — its Findings section names three recurring causes clearly. But the appendix where the eleven individual incidents are described doesn't connect back to them, leaving the reader to do the cross-referencing by hand.
1. PSNI, 2023. Personal data of c10,000 officers published in an FOI response. The data was contained in a separate worksheet within the main spreadsheet and was not spotted during checks.
5. MOD, 2021. 245 ARAP applicants emailed in copy rather than blind copy. The email addresses of the applicants were placed in copy rather than blind copy field.
7 of 11 incidents trace to 3 recurring causes
| Incident | Cause | Outcome |
|---|---|---|
| PSNI, 2023 | Up to £217m est. cost | |
| Norfolk & Suffolk Police, 2021–23 | ICO investigation ongoing | |
| MOD (.ml domain), 2023 | Wrong-recipient email | National security risk |
| MOD (ARAP), 2021 | Wrong-recipient email | Threat to life risk |
| IICSA, 2017 | Wrong-recipient email | £200k ICO penalty |
| Cabinet Office (Honours), 2019 | Ad-hoc / system config | £500k ICO fine |
| HMRC, 2008 | Ad-hoc / system config | Public confidence damage |
| Digital ID; NHS Lanarkshire; DWP x2; Public Health Wales | Other / descoped | Varied |
All eleven incidents in full narrative detail, plus the review's recommendations grouped by process, technology, policy, and culture.
Incidents are grouped by what caused them, connecting the appendix back to the report's own named findings.
"7 of 11 trace to 3 causes" is the finding a reader actually needs, stated up front.
Nothing is lost — the source report remains the place for incident-level detail.
This report had already done the hard part — finding what was shared across eleven separate incidents. The write-up format then obscured its own conclusion by defaulting to narrative order instead of the order that mattered: cause.
If you've got an incident review, RCA, or reliability report where the pattern across cases is real but buried in narrative order, I'll take one section and redesign it — no cost, no obligation — the same way as above.