The UK government has confirmed that the personal information of half a million members of the UK Biobank health data project was offered for sale online in China. Technology minister Ian Murray informed MPs that details of all 500,000 members of the database were found listed for sale on the e-commerce platform Alibaba, describing the incident as an “unacceptable abuse” of the data.
Details of the Breach
Mr Murray told the House of Commons that the Biobank charity reported the data breach to the government on Monday. He noted that the compromised information did not include names, addresses, contact details, or telephone numbers. The data had been legitimately downloaded by three research institutions in China, which have since had their access revoked. The government is now working to establish how the breach occurred.
According to Mr Murray, no purchases were made from the three listings on Alibaba, and they have been taken down. He expressed gratitude to the Chinese government for their cooperation in removing the listings.
Biobank’s Response
Sir Rory Collins, chief executive of UK Biobank, announced that the charity has temporarily closed access to the research platform. He apologised to participants and stated that additional security measures will be implemented to prevent future incidents. “We apologise to our participants for the concern this will cause, and we hope to provide reassurance by outlining the serious actions we are taking in response,” Sir Rory said. “Your personally identifying information in UK Biobank is safe and secure.”
Nature of the Data
Biobank removes personal identifying information such as names and addresses before granting scientists access to data. This means details like names, addresses, dates of birth, and NHS numbers are not contained in the dataset. However, Mr Murray acknowledged that he could not provide a complete guarantee that individuals could not be identified, though he suggested it would require a “very advanced way” to do so.
The UK Biobank is the world’s most comprehensive dataset of biological, health, and lifestyle information. It has been instrumental in advancing the detection and treatment of dementia, cancers, and Parkinson’s disease. Participants joined the study between 2006 and 2010, aged 40 to 69 at the time.
Government Action
Mr Murray emphasised the seriousness of the breach, stating, “This is an unacceptable abuse of the UK Biobank charity’s data and abuse of the trust that participants readily expect when sharing the data for research purposes.” He confirmed that the government will soon issue new guidance on controlling data from research studies and urged all businesses and charities to ensure their systems and data-sharing processes are as secure as possible.
The minister also noted that the government had recently written to businesses about free cyber security tools available to them and the steps they should take to maximise security. “Ensuring the safe use of UK data is a priority for this government,” he added.
