Two Investigations, One Traumatised Family: The Full Story of the Crocodile Attack at Johnsons of Old Hurst

A story that began with a three-year-old boy in critical condition at a family zoo in Cambridgeshire has developed this week into two simultaneous and overlapping investigations — one criminal, still seeking to establish precisely how a young child ended up inside a crocodile enclosure on a Thursday afternoon, and one concerning patient data privacy, asking why up to 40 members of staff at a Cambridge hospital accessed that same child's medical records without established authorisation. Both investigations reflect the serious and layered consequences of an event that has shocked the country since it first broke on June 19, 2026. The good news, confirmed by Cambridgeshire Police in an update issued this week, is that the boy is now in a stable condition at Addenbrooke's Hospital and is no longer critical. Everything else about this story remains deeply unsettled.

The Incident: What Is Known and What Is Not

At approximately 1:30pm BST on Thursday, June 19, 2026, Cambridgeshire Police were called to Johnsons of Old Hurst, a family-run farm and zoo located near Huntingdon in Cambridgeshire, approximately 100 kilometres north of London. The report was of a young child suffering serious injuries inside the zoo's crocodile enclosure. Officers arrived within minutes. They found a three-year-old boy, who has not been named by police or his family, who had been in the enclosure and had sustained serious injuries.

Zoo staff had already intervened before police arrived. Staff members pulled the boy out of the enclosure — in at least one account, the wife of the zoo owner, Tracey Johnson, is described as jumping in to retrieve the child. The boy was given medical treatment at the scene and then transported by emergency services to Addenbrooke's Hospital in Cambridge, where he was placed in critical but stable condition. His family, who are from Cambridgeshire, had been visiting the zoo together when the incident occurred.

What is less clear, and what the ongoing criminal investigation is working to establish, is how the child came to be inside the crocodile enclosure in the first place. Police have not confirmed whether the boy fell in, climbed in, or was placed there by another person. What they have confirmed is that within hours of arriving at the scene, they arrested a 30-year-old man from Norfolk on suspicion of attempted murder. That arrest — and the specific nature of the suspicion — immediately and dramatically shaped public understanding of the incident.

Detective Inspector Verity McCann, leading the Cambridgeshire Constabulary investigation, stated in the immediate aftermath that at this stage we are speaking to people who were at the zoo at the time of this distressing incident to understand more about the circumstances. We do not believe the man arrested and the child are known to each other — a declaration that placed an apparent stranger at the heart of an incident involving a toddler in a crocodile enclosure, and that raised questions the investigation has not yet publicly answered.

The arrested man was released on bail on Friday, June 20, after investigators confirmed he was assessed as not being fit for police interview. His bail conditions and the terms of the ongoing investigation have not been publicly disclosed. He has not been charged, and no further arrests have been announced as of the time of writing.

The Nature of the Injuries: What Witnesses Described

In the immediate aftermath of the incident, conflicting accounts emerged about the precise nature of the boy's injuries and whether the crocodile actually made contact with the child. A witness who spoke to The Sun described a scenario in which the boy sustained a broken pelvis and a broken arm from the fall itself rather than from the crocodile. "Apparently the boy has a broken pelvis and a broken arm, but thankfully the crocodile didn't actually get to him," the witness said. "Someone was able to jump in and get him out of the water. It could have been so much worse, but he's obviously got some really serious injuries from the fall. None of the injuries were from the crocodiles, thank God."

Cambridgeshire Police's formal public statements have described the boy as having sustained serious injuries while in the enclosure, without specifying whether those injuries were caused by the fall into the enclosure, the crocodile, or both. The medical picture at Addenbrooke's — which would be the most precise available source on the nature and cause of the child's injuries — is precisely what is at the centre of the second investigation running in parallel with the criminal one.

Johnsons of Old Hurst, a zoo that describes itself as a working farm with a collection of exotic reptiles and other animals, issued a statement on its social media channels on the day of the incident: our thoughts and prayers are with the boy and his family following the incident that occurred today. The zoo's Tropical House, where the crocodiles are kept, was closed in the immediate aftermath out of respect for the boy and his family, and remained closed while investigations continued.

The Data Breach: 40 Staff, One Child's Records

On Thursday, June 26, 2026 — exactly one week after the incident — Cambridge University Hospitals NHS Foundation Trust, which manages Addenbrooke's Hospital, announced that it had launched a formal investigation and referred itself to the Information Commissioner's Office after discovering that the medical records of the injured boy had been accessed by approximately 40 members of staff.

The hospital's statement was careful but clear: Cambridge University Hospitals said it was exploring if there were legitimate reasons for the records to be accessed. Where any member of staff is found to have accessed patient records without legitimate clinical or operational reasons we take robust disciplinary action, the trust added.

The ICO referral is a legally required step under UK data protection law whenever a public body identifies or suspects a breach of the UK GDPR — the retained version of the General Data Protection Regulation that applies in the United Kingdom following Brexit. Self-referral, as Cambridge University Hospitals has done here, is considered best practice and typically reflects well on an organisation's governance posture, as it demonstrates that the institution's own monitoring systems detected the breach and that it is disclosing proactively rather than waiting for an external complaint or investigation. The ICO has confirmed it is assessing the referral.

The specific concern with hospital records is the sensitivity of the information they contain. Medical records are classified under the UK GDPR as special category personal data — the highest tier of protection under British data protection law, requiring specific lawful bases for processing and the most stringent access controls. A child's medical records are also protected by additional considerations relating to the rights of children under both data protection law and the common law of confidentiality. The records of a three-year-old patient being treated in the immediate aftermath of a serious injury, including details of the nature, extent, and treatment of those injuries, are information of the most private and sensitive kind.

For hospital staff to access patient records, they are required to have a legitimate clinical or operational reason for doing so — meaning they must be part of the clinical team treating the patient, or have a specific administrative function that requires access. Accessing records out of curiosity, because a patient has been in the news, or to share information with others, is a breach of both the hospital's internal policies and the UK GDPR, regardless of whether any information is actively disclosed beyond the person who accessed it. The access itself, without authorisation, constitutes the breach.

Approximately 40 individuals accessing the records of a single child patient is an unusually high number for a case like this, and it is consistent with a pattern that healthcare data protection specialists describe as voyeuristic browsing — access driven by the high-profile public nature of the incident rather than by any clinical need. It is a pattern that has been seen in other cases involving high-profile patients or incidents. The ICO's chief executive has issued explicit warnings on this subject, noting that knowingly or recklessly accessing personal data without authorisation can lead to disciplinary action, loss of professional accreditation, and in the most serious cases, prosecution under the Computer Misuse Act or the Data Protection Act 2018. Section 170 of the Data Protection Act 2018 specifically creates a criminal offence of knowingly or recklessly obtaining, disclosing, or retaining personal data without the consent of the controller.

What the ICO Can Do

The Information Commissioner's Office, which regulates data protection law compliance for organisations in the United Kingdom, has a range of enforcement powers that can be deployed following a personal data breach. At the lower end, the ICO can issue a reprimand — a formal statement that the organisation has failed to comply with data protection law, which is recorded and published but carries no financial penalty. It can issue an enforcement notice requiring the organisation to take specific steps to comply with the law within a specified period. At the higher end, for serious breaches, it can issue a penalty notice carrying a financial fine of up to £17.5 million or four per cent of global annual turnover, whichever is higher, under the UK GDPR's penalty regime.

For Cambridge University Hospitals, an NHS Foundation Trust operating with a significant annual budget, the financial risk of an ICO penalty is real. More significant in practical terms, however, may be the reputational and regulatory consequences of a finding that the hospital's access control systems were not sufficiently robust to prevent 40 staff members accessing a high-profile child patient's records without clinical justification, and that the monitoring systems were not fast enough to prevent the pattern from developing to that scale before it was detected.

The trust's decision to self-refer promptly and to issue a public statement acknowledging the investigation is the right procedural response and is likely to be noted positively by the ICO in any subsequent assessment. The outcome for individual members of staff found to have accessed the records without clinical authorisation is a separate matter governed by their employment contracts, the NHS Code of Conduct, and potentially their professional regulatory bodies — the Nursing and Midwifery Council or the General Medical Council, depending on the staff members involved — each of which maintain their own fitness to practise frameworks that can result in suspension or removal from professional registers.

The Zoo: Context and Closure

Johnsons of Old Hurst is not a large commercial zoo but a family-run attraction in the Cambridgeshire village of Old Hurst, operating on a farm site and offering visitors access to exotic animals including reptiles, alongside more conventional farm animals and rural activities. The Tropical House — the enclosure housing the zoo's crocodiles — was closed immediately following the incident and remained closed as of the most recent public communications from the zoo.

The zoo's owners have not made public statements beyond their initial expression of concern for the boy and his family. The Health and Safety Executive, which regulates workplace safety in the United Kingdom including safety at zoos and animal attractions, was expected to carry out its own assessment of the circumstances of the incident and the zoo's safety management systems, though no formal announcement of an HSE investigation had been made in the public record available as of this writing.

The Boy: The Most Important Update

Amid all the investigations and the legal processes, the most significant development of the past week is the one that has received the least sustained attention in the torrent of coverage: the three-year-old boy at the centre of all of this is getting better. Cambridgeshire Police confirmed in an update this week that the child's condition had improved and he was no longer critical. He is now in a stable condition at Addenbrooke's Hospital, receiving the care that the team there has been providing since the afternoon of June 19.

The child has not been named. His family has not spoken publicly. They are navigating an experience of a kind that no family should have to navigate — the terror of an injured child, the shock of what happened, and now the knowledge that up to 40 people looked at their son's medical records in the aftermath of an event that was already among the most traumatic of their lives.

The criminal investigation continues. The data protection investigation continues. The criminal justice question of whether someone placed a three-year-old child inside a crocodile enclosure — and if so, why — remains unanswered. But the child, who was pulled from that enclosure by zoo staff and rushed through emergency medicine at one of the country's leading hospitals, is alive and stable.

Everything else, ultimately, is secondary to that.

Sources

Occasional Digest — Hospital probe after crocodile attack boy's records are accessed (June 26, 2026): https://occasionaldigest.com/hospital-probe-after-crocodile-attack-boys-records-are-accessed/

Prism News — Cambridge hospital reports data breach after boy's crocodile attack treatment (June 26, 2026): https://www.prismnews.com/news/cambridge-hospital-reports-data-breach-after-boys-crocodile

NBC News — 3-year-old critically injured by crocodile after ending up in its enclosure in British zoo (June 19–20, 2026): https://www.nbcnews.com/world/europe/three-year-old-critically-injured-ending-crocodile-enclosure-uk-zoo-rcna350845

ABC News — Man arrested after 3-year-old boy critically injured in crocodile enclosure (June 19, 2026): https://abcnews.com/International/man-arrested-after-3-year-boy-critically-injured/story?id=134004788

ABC News — Suspect charged after 3-year-old boy injured in crocodile enclosure released on bail (June 20, 2026): https://abcnews.com/International/suspect-charged-after-3-year-boy-wound-crocodile/story?id=134031662

The Nightly — Johnsons of Old Hurst Zoo: Investigation continues after boy allegedly thrown into crocodile pen (June 23, 2026): https://thenightly.com.au/world/johnsons-of-old-hurst-zoo-investigation-continues-after-boy-allegedly-thrown-into-crocodile-pen-c-22469568