world
UK Biobank Data from 500,000 Participants Breached and Briefly Listed on Alibaba Before Removal
Data from the UK Biobank, containing health information from 500,000 volunteers, was advertised for sale on Alibaba's e-commerce platforms in China. The government confirmed the listings were removed after coordination with Alibaba and Chinese authorities. No purchases occurred before the takedowns, and the data excluded names and contact details.
DI
David Lally / Wikimedia (CC BY-SA 2.0)Audio version
Tap play to generate a narrated version.
Data from the UK Biobank, encompassing genetic, biological, and health information from 500,000 volunteers, was hacked and offered for sale on Alibaba's e-commerce platforms in China. The breach involved three listings that appeared to sell participation data, with at least one dataset containing information from all 500,000 volunteers.
Additional listings on Alibaba offered support for applying for legitimate access to UK Biobank or analytical support for researchers with existing access.
UK Biobank informed the government on April 20 that their data had been advertised for sale by several sellers on Alibaba. Ian Murray, the science minister, told the Commons on Thursday that the government spoke to the vendor that day and they did not believe there were any purchases from the three listings before they were taken down.
The stolen data did not contain participants’ names, addresses, contact details or telephone numbers.
The data contained gender, age, month and year of birth, as well as assessment centre data, attendance data, socioeconomic status and lifestyle habits. Government ministers admitted there was a large-scale data breach resulting in information being stolen. Confidential medical data belonging to 500,000 British citizens was put up for sale on Alibaba.
UK Biobank discovered the listings last week. The government worked with UK Biobank, the Chinese government and Alibaba to have the listings removed. Ian Murray thanked the Chinese government for the speed and seriousness with which they worked to remove the listings and for ongoing work to remove further listings.
The government ensured that UK Biobank revoked access to the three research institutions identified as the source of the information. The government asked UK Biobank to pause further access to its data until a technical solution is put in place to prevent data from being downloaded. The incident was a legitimate download by a legitimately accredited organisation, not a leak.
