UK Biobank health data on sale in China, UK government confirms

Share

The British government has confirmed a significant security incident involving the medical records of half a million UK citizens.

Data from UK Biobank, a major health research project used to study life-altering diseases such as cancer and dementia, was discovered listed for sale on the Chinese e-commerce platform Alibaba.

Technology Minister Ian Murray informed MPs that the breach involved the “de-identified” health data of nearly all the project’s 500,000 participants. While the government and UK Biobank stressed that the listings have since been removed and no purchases were made, the incident has sparked a fierce debate over the safety of the UK’s most sensitive medical assets.

The data involved in the breach includes highly specific information: gender, age, month and year of birth, socioeconomic status and lifestyle habits, alongside measurements derived from biological samples. Crucially, UK Biobank Chief Executive Professor Sir Rory Collins reassured volunteers that the set did not include names, addresses, phone numbers, or NHS numbers.

Unlike a typical “cyber-attack” or external hack, the government revealed that the data ended up on the Chinese web through a profound breach of contract. The information was originally shared via a “legitimate download” by researchers at three accredited academic institutions. Rather than a technical failure, the breach occurred when those researchers, who were contractually bound to keep the data secure for health research, placed the information for sale online.

Sir Rory Collins confirmed that access for these three institutions and the individuals involved has been suspended. Following the discovery, the UK and Chinese governments worked with Alibaba to “swiftly” take down the three separate listings.

Political fallout

The incident has triggered a sharp political divide in the House of Commons. Reform UK’s Richard Tice labelled the event a “China data theft scandal,” questioning whether Chinese researchers should be banned from the database entirely. In contrast, Minister Murray defended the role of international collaboration, noting that thousands of Chinese researchers have used the data “safely and securely” since 2012.

To prevent future incidents, UK Biobank has launched a forensic board-led investigation. It has also implemented immediate restrictions, including a temporary suspension of its research platform, strict limits on the size of files that can be exported, and daily monitoring for suspicious activity.

While some volunteers remain unfazed due to the data’s anonymization, the Information Commissioner’s Office has launched formal enquiries to determine if the charity met its legal responsibilities to protect the public’s medical history.

For latest tech stories go to TechDigest.tv