Initially four hard drives sold eBay in October and November 2010 were found to contain were found to contain sensitive personal data of both patients and staff . Despite the Trust 's assurance that these were the only drives lost , further hard drives were recovered by the ICO after being sold on eBay . The Trust was unable to explain how an unnamed individual , who was sub - contracted by a sub - contractor to the IT supplier to the Trust to destroy the 1,000 hard drives , managed to remove at least 252 of the 1,000 hard drives he was supposed to be destroying from the hospital during his five days on the premises . Despite the security precautions taken there were insufficient records taken to provide a reliable audit trail of which hard drives were and were not destroyed . The Information Commissioner ( ICO ) ended up imposing a fine of 325,000 after sensitive patient data of thousands of people was discovered on hard drives sold on eBay . An investigation found that at least 232 de - commissioned drives that should have been deep cleaned and destroyed by a contractor ended up being sold second hand . ;