A hospital trust has admitted that nearly 50 staff members looked inappropriately at the medical records of victims of the Southport knife attack.
The data breach happened at Aintree Hospital in Liverpool, where some of the injured were treated, in the days after the July 2024 attack but has only emerged this week.
The BBC understands the three patients affected included a 13-year-old girl who had been helping to supervise the Taylor Swift-themed dance class that was targeted in the attack - and adult teacher Leanne Lucas.
The NHS University Hospitals of Liverpool Group (UHLG), which runs Aintree, said the breach was "inexcusable" and changes had been made - although no-one has been sacked.
Lucas was stabbed five times in the attack, which killed three young girls and seriously wounded eight children and another adult.
"I am absolutely devastated and horrified that my privacy has been invaded when I was at my most vulnerable," she said.
"Nothing will take away my gratitude to the staff who saved my life, but 48 people not involved in my care abused their position of trust to access the files of victims who have suffered unspeakable trauma."
It is understood that the breach emerged as part of a standard information access audit carried out by the trust in the days after the attack.
Nicola Ryan-Donnelly, from Fletcher's Solicitors which represents the teenage patient, said: "This is a deeply disturbing abuse of power and a shocking breach of privacy into the care of several Southport victims, including a young girl.
"Our client, who is now growing into a young woman, is old enough to properly understand what this means: that staff opened her records, not to aid to her recovery but to pry."
The Chief Executive of UHLG, James Sumner, said the trust was "sincerely sorry for any distress that may have been caused to the patients".
He said that staff who were found to have accessed patient records were subject to disciplinary processes ranging from "informal counselling to a final written warning". None of the staff members were dismissed.
Lucas said: "The decision to keep this from me for almost two years is a new low.
"I am speaking out as I want this scandal and the attempted cover up by senior management exposed for what it is."
She told the BBC she only learned about the data breach on Thursday when the hospital's chief nurse spoke to her.
Lucas believes that it was only revealed to her because a journalist from the Health Service Journal had contacted the hospital.
She added: "I'm also angry that the Information Commissioner's Office was told about it in August 2024, and I've only been told now because I was about to read about it in a paper."
The trust has denied a cover-up.
Sumner said the decision not to inform the patients was taken on clinical advice, "taking into consideration the potential psychological impact it may have upon them at the time".
He added that the "relevant regulators and professional bodies" were contacted.
The Information Commissioner's Office said it was not intending to start a criminal investigation "at this time", but added: "We continue to remind all healthcare organisations about the importance of keeping patient data secure."
Solicitor Nicola Brook, of Broudie Jackson Canter, which represents adult survivors of the attack, said: "This is a truly unbelievable breach of privacy for victims of one of the most horrific attacks this country has ever seen.
"This is more than a few bad apples when it was 48 different members of staff who for no legitimate reason, chose to access vulnerable victims' records.
"That speaks to a culture, and one that will only change if there are real consequences for those responsible.
"For the Trust to then try to hide that it happened is appalling. The Trust has many questions to answer and we will be ensuring our clients get those answers as soon as possible."
Ryan-Donnelly described the two-year delay in telling her client as "absolutely shameful".
She also called on the Trust to give more answers to the teenage girl's family, and for staff to "face proper accountability".
The Labour MP for Southport, Patrick Hurley, told the BBC he was "deeply concerned" by reports of the data breach.
He said: "The suggestion that confidential records may have been accessed without legitimate reason, particularly at a time when survivors and families were at their most vulnerable, is profoundly troubling."
He added: "We must make sure this doesn't happen again, either here in Southport or in other high profile cases where people are receiving confidential health care."
Layla Moran MP, Chair of the Health and Social Care Committee, said that any breach of this kind "fundamentally undermines patient confidence".
The Shadow Health Secretary, Stuart Andrew, said: "Any inappropriate access to confidential medical records is a serious violation of that trust and should never have happened.
"The vast majority of NHS staff uphold the highest professional standards every day under immense pressure. Where those standards are breached, it is right that disciplinary action is taken."
The UHLG said in a statement: "Breaches of patient confidentiality are inexcusable and undermine the hard work of those teams who sought to provide the highest standard of care to these patients after they experienced such traumatic and life-changing events.
"Staff who were found to access patient records were subject to HR disciplinary processes.
"When we concluded our investigation into the incident, we consulted the clinical team who had managed the patients' care and made a decision not to inform the patients involved, taking into consideration the potential psychological impact it may have upon them at the time.
"We notified the relevant regulators and professional bodies, including the ICO, and were fully transparent about any findings and actions taken. Learning from the incident has led to the introduction of a digital solution which reduces inappropriate access to patient records of this nature."
Listen to the best of BBC Radio Merseyside on Sounds and follow BBC Merseyside on Facebook, X, and Instagram. You can also send story ideas via Whatsapp to 0808 100 2230.
