Private health records of half a million Britons offered for sale on Chinese website | Data and computer security
The UK government has confirmed that confidential health records of half a million British volunteers are up for sale on Chinese website Alibaba.
Data on UK Biobank project participants were put up for sale in three separate lists last week. The records have now been removed and no sales are believed to have taken place.
The latest breach comes after the Guardian revealed last month that UK Biobank data had been exposed online dozens of times, raising new questions about whether security was too lax.
Technology minister Ian Murray told the House of Commons: “On Monday 20 April, the UK Biobank charity notified the government that it had identified its data being offered for sale by a number of sellers on Alibaba’s e-commerce platforms in China.
“Biobank told us that three listings that appeared to be selling… Biobank engagement data had been identified. It turned out that at least one of these three datasets contained data from all 500,000 Biobank volunteers in the UK.”
The data available for sale has been “de-identified”, meaning it does not contain names, addresses or exact dates of birth.
The UK Biobank stores the health data of 500,000 volunteers, including genome sequences, brain scans, blood samples and diagnostic records. Scientists at universities and private companies around the world applied for access and were free to download the data directly to their own computer systems until late 2024; This was something experts had repeatedly warned was a security risk.
In February, health minister Wes Streeting signed a deal. legal aspect This enabled coded GP data from all volunteers to be shared with the UK Biobank for the first time.
Murray said the government is working with Biobank, the Chinese government and Alibaba to remove the listings. “I want to thank the Chinese government for the speed and seriousness with which they worked with us to help remove these lists and the ongoing work to remove other lists,” he said.
“Secondly, we have asked the Biobank charity to revoke access to three research institutions identified as the source of this information. Thirdly, we have asked the Biobank charity to pause further access to its data until it has implemented a technical solution to prevent data on its existing platform from being downloaded.”
He said Biobank only worked with “accredited institutions and organizations and individual academic researchers”, adding: “This was not a leak. This was a legitimate download by a legally accredited organisation.”
UK Biobank referred itself to the Information Commissioner’s Office.
Prof Rory Collins, CEO and principal investigator at UK Biobank, said: “We take the protection of participants’ data extremely seriously and do not tolerate any data misuse. With the support of the UK government, Chinese authorities and Alibaba, three lists of de-identified data were swiftly removed before sale. Their actions were a clear breach of their contract with UK Biobank and their access, along with their academic institutions, were immediately suspended.”
“We apologize for the concern this will cause and have already implemented technology, processes and a board-led review to prevent this from happening again. We have also taken our research platform offline while adding another upgrade to help prevent de-identifying data from being removed from the platform. We expect this to take three weeks. Our current plans to implement an automated ‘airlock’ that controls files and data are well underway.”
