The UK government has confirmed that sensitive medical information from 500,000 participants in the UK Biobank initiative was advertised for purchase on the Chinese platform Alibaba. The listings, discovered last week across three separate posts, have since been taken down, with no transactions believed to have occurred. This incident follows a recent report by the Guardian highlighting multiple online exposures of UK Biobank data, prompting concerns about inadequate safeguards. Technology Minister Ian Murray informed Parliament that on April 20, the UK Biobank organization notified authorities of the advertisements on Alibaba’s marketplaces in China. He noted that at least one dataset appeared to include information from all 500,000 participants. The data was anonymized, excluding personal identifiers like names, addresses, or exact birth dates. The UK Biobank collects health details from volunteers, such as genetic information, brain imaging, blood tests, and medical histories. Researchers from academic and commercial entities worldwide can request access, and until late 2024, they could transfer data directly to their systems—a practice experts have flagged as risky. In February, Health Secretary Wes Streeting authorized the sharing of coded general practitioner records with UK Biobank for the first time. Murray explained that the government collaborated with UK Biobank, Chinese officials, and Alibaba to eliminate the listings. He expressed appreciation for the prompt response from Chinese authorities in addressing the issue and preventing future occurrences. Additionally, access was revoked for the three research entities linked to the data’s origin. The government has directed UK Biobank to suspend further data access until implementing measures to block downloads from its platform. Murray clarified that the organization partners only with verified institutions and researchers, describing the event as a misuse of authorized access rather than a direct leak. UK Biobank has reported the matter to the Information Commissioner’s Office. Professor Rory Collins, the organization’s chief executive and lead researcher, emphasized their commitment to data security and intolerance for misuse. With assistance from UK and Chinese authorities and Alibaba, the anonymized data listings were quickly removed without any sales. The individuals involved violated their agreements, leading to immediate suspension of access for them and their institutions. Collins apologized for any distress caused and outlined steps including new technology, procedures, and a board review to prevent recurrences. The research platform has been temporarily deactivated for upgrades to restrict data removal, expected to last three weeks, while plans for an automated verification system proceed.
