UK Biobank Data from 500,000 Participants Breached and Briefly Listed on Alibaba Before Removal

Data from the UK Biobank, encompassing genetic, biological, and health information from 500,000 volunteers, was hacked and offered for sale on Alibaba's e-commerce platforms in China. The breach involved three listings that appeared to sell participation data, with at least one dataset containing information from all 500,000 volunteers.

Additional listings on Alibaba offered support for applying for legitimate access to UK Biobank or analytical support for researchers with existing access.

UK Biobank informed the government on April 20 that their data had been advertised for sale by several sellers on Alibaba. Ian Murray, the science minister, told the Commons on Thursday that the government spoke to the vendor that day and they did not believe there were any purchases from the three listings before they were taken down.

The stolen data did not contain participants’ names, addresses, contact details or telephone numbers.

The data contained gender, age, month and year of birth, as well as assessment centre data, attendance data, socioeconomic status and lifestyle habits. Government ministers admitted there was a large-scale data breach resulting in information being stolen. Confidential medical data belonging to 500,000 British citizens was put up for sale on Alibaba.

UK Biobank discovered the listings last week. The government worked with UK Biobank, the Chinese government and Alibaba to have the listings removed. Ian Murray thanked the Chinese government for the speed and seriousness with which they worked to remove the listings and for ongoing work to remove further listings.

The government ensured that UK Biobank revoked access to the three research institutions identified as the source of the information. The government asked UK Biobank to pause further access to its data until a technical solution is put in place to prevent data from being downloaded. The incident was a legitimate download by a legitimately accredited organisation, not a leak.

UK Biobank works with accredited organisations, institutions and individual academic researchers. UK Biobank has referred itself to the Information Commissioner’s Office. Professor Sir Rory Collins, UK Biobank chief executive, said: “We apologise to our participants for the concern this will cause.

We take the protection of your data extremely seriously. Researchers have to go through our rigorous access review process, and their institutions sign a contract committing to keep the data secure, before we make the data available to them for research.

Even though we only ever share de-identified data and have no evidence of any of you being identified unwillingly, we don’t want any use by anyone who has not been approved for access.

” UK Biobank is a database containing genetic, biological, and health data from 500,000 UK participants. Participants were aged between 40 and 69 years old when they joined the study between 2006 and 2010. UK Biobank holds de-identified biological samples and health data from 500,000 volunteers recruited between 2006 and 2010 and aged between 40 and 69 at the time.

The data is used to track participants' long-term health and help researchers understand, prevent and treat serious illnesses. UK Biobank data has been used to achieve improvements in detection and treatment of dementia, cancers and Parkinson’s. UK Biobank has enabled scientists to study the onset of diseases such as cancer and heart disease.

UK Biobank contains more than 15 million biological samples. It is the world’s largest database of human genome sequencing, proteomic and human imaging. UK Biobank is funded by the Medical Research Council, the government and charitable sources.