Hidden tabs and rows: how spreadsheets leak data you meant to remove

A spreadsheet can look harmless on screen and still carry thousands of records you can't see. Hidden tabs, hidden rows and hidden columns travel with the file wherever it goes. Two of the most damaging UK data breaches of recent years started exactly this way.

Two cases

A freedom of information response, 2023. The Police Service of Northern Ireland answered an information request with a spreadsheet that contained a hidden tab. According to the Information Commissioner's Office, that tab held the surname, initials, rank and role of all 9,483 serving officers and staff. The people who checked the file looked only at the visible tab. The ICO confirmed a £750,000 fine in October 2024.

An email to a trusted contact, 2022. A UK Ministry of Defence official emailed a spreadsheet believed to contain details of a small number of Afghan relocation applicants. Hidden in the file were records covering nearly 19,000 more people, according to reporting on the breach. The breach stayed secret under a court order until July 2025, and in July 2026 a parliamentary committee called it "foreseeable", noting that guidance on hidden data in spreadsheets was long established.

In both cases, nobody intended to share the hidden data. They simply couldn't see it.

Where data hides in a spreadsheet

• Hidden worksheets (tabs). A whole sheet can be hidden and still saved in the file.
• Hidden rows and columns. Filtered or hidden ranges are invisible until someone unhides them.
• Cells formatted to look empty, such as white text on a white background.
• Comments, notes and document properties, including author names.
• Pivot caches and external links, which can keep a copy of source data even after the visible sheet is trimmed.

How to check a spreadsheet before you send it

1. Ask whether it needs to be a spreadsheet at all. If the recipient only needs to read the figures, send the visible pages as a PDF instead of the live workbook.
2. Run Excel's Document Inspector. Microsoft's guide explains that it can find and remove hidden rows, columns and worksheets, along with comments and personal information. Run it on a copy: Microsoft warns that removing hidden data can change formula results and may not be undoable.
3. Unhide everything and look. Right-click the sheet tabs to check for hidden sheets, and select the whole sheet to unhide rows and columns before you decide what stays.
4. Copy only what's needed into a new file. Paste values into a fresh workbook, which leaves hidden sheets, formulas and history behind.
5. Have a second person check, especially for anything published, such as a freedom of information response or a court bundle.

Where Ombly fits

Ombly turns spreadsheets into their printed pages before anything is redacted, and the export is rebuilt from those pages. Hidden sheets, rows and columns aren't part of what's printed, so they aren't part of what you share. Review the converted pages to make sure everything the recipient needs is visible. For teams, Ombly runs on your own servers. Book a call, or read how to remove metadata before you share a document.