Sensitive health data from a UK biobank, potentially affecting nearly 500,000 participants, was briefly put up for sale in the Chinese market. British authorities moved quickly to remove the lists, but the incident raised new concerns about the security of the vast research database.
Sensitive health data linked to nearly 500,000 UK biobank participants was briefly listed for sale on a Chinese online marketplace, prompting British authorities to take swift action to remove the posts.British Technology Minister Ian Murray told lawmakers that the listings were quickly removed after they were reported, with officials coordinating with Chinese authorities and the platform operator. The disclosures, reported by The Guardian, have raised new concerns about the security of one of the world’s largest health research databases.The UK Biobank contains extensive medical information, including genetic data, diagnostics, brain scans and blood samples, which is used by researchers globally under strict access controls.
Recently, anonymized general practice data has also been added, expanding the scope of the data set and the risks associated with it.According to officials, three listings were identified on a platform linked to Alibaba, with one data set potentially covering a significant portion of participants. While the data has been described as anonymised, experts warn that these datasets can sometimes be re-identified when combined with other publicly available information.
Chi Onwurah, who chairs the House of Commons science and technology committee, said repeated incidents could undermine public confidence and discourage participation in large-scale health research. Academics have also raised concerns, with some calling it a serious oversight failure and warning that once the data is disclosed, it is difficult to fully contain it.In response to the hack, Rory Collins, head of UK Biobank, said the organization takes data protection “very seriously” and has launched a review of its security systems. Efforts are being made to strengthen digital safeguards, including tools to detect and prevent unauthorized data transfers.
