The details of more than 18,000 people who tested positive for coronavirus were published online by mistake by Public Health Wales.
The health body said the data of 18,105 Welsh residents was viewable online for 20 hours on 30 August.
Most cases gave initials, date of birth, geographical area and sex, meaning the risk of identification was low, Public Health Wales (PHW) said.
However 1,928 people in living in communal settings were more at risk.
Nursing home residents or those living in supported housing also had the name of their place of residence published, meaning the risk, while still considered low, was higher.
The incident was the result of “individual human error” when the information was uploaded to a public server searchable by anyone using the site.
PHW said the information had been viewed 56 times before it was removed but there was no evidence so far that the data had been misused.
