Science minister Patrick Vallance has revealed that additional confidential health records of UK Biobank volunteers have been posted on the Chinese website Alibaba since the breach was first reported last week. Speaking in the House of Lords, Lord Vallance said the government is working with Chinese officials to remove the listings and is braced for further leaks.
The data, which belongs to 500,000 UK Biobank volunteers, is “de-identified” and does not include names, addresses or precise dates of birth. Vallance said there is a “low probability” of re-identification but warned that the breach should be a “real wake-up call” for researchers, as triangulation in large datasets can pose identification risks.
Last month, the Guardian was able to re-identify a single participant from a different leaked UK Biobank dataset using only date of birth and operation data. Vallance named three Chinese institutions believed to be behind the postings: Second Xiangya Hospital, China-Japan Union Hospital, and Beijing Chaoyang Hospital.
Technology minister Ian Murray made an emergency statement last Thursday revealing the initial breach. UK Biobank learned of it from an anonymous whistle-blower. Officials do not believe any sales occurred, but all access to UK Biobank data has been temporarily suspended.
Vallance praised the altruism of volunteers and emphasised the importance of UK Biobank for medical research, calling the leak “appalling.” He stressed the need for a secure data environment to eliminate such risks. Separately, UK Biobank has acted on at least 30 other data breaches in the past month, including a dataset of 96,000 volunteers accidentally uploaded by a Yale University student, which remains online despite requests for removal.
