Anatomy of a Spreadsheet Failure, Analysing the EuSpRIG Horror Story Corpus

Abstract

Spreadsheet disasters have been documented for more than thirty years, but they have not gone away. This paper examines the EuSpRIG horror stories archive as evidence of how ordinary spreadsheets fail and the consequences that follow. After cleaning and deduplication, 121 incidents from 1995 to 2026 were classified into twelve failure categories and analysed by mechanism, context and consequence. Formula errors, data-entry slips and data-handling mistakes account for 71 cases and recur across the whole period, from Fidelity's missing minus sign in 1995 to a mistyped date that cost Norway's sovereign wealth fund about $92 million in 2024. A second pattern concerns information present in a workbook but not visible to the recipient: hidden rows, hidden sheets, pivot-table caches, embedded objects and retained source layers can cause harm even when no calculation is wrong. The clearest rise in reported cases is in this hidden or embedded data category, whose most serious example is the 2022 Ministry of Defence spreadsheet that exposed details of roughly 18,700 Afghan applicants through hidden rows. The paper argues that spreadsheet risk is no longer only a problem of wrong numbers. It also involves visibility, disclosure, governance and trust. Existing taxonomies remain useful for formula, entry and handling errors, but do not fully capture the public harm caused by spreadsheets used as uncontrolled operational infrastructure. The same mistakes have persisted for three decades, what has changed is the authority organisations give to the spreadsheets that contain them.